Geïnfecteerde advertenties op nu.nl

Fox-IT observed that on 5 June visitors to nu.nl were infected via a compromised advertisement provider that redirected to the Sweet Orange exploit kit; a Java exploit delivered an encrypted loader which fetched a ZeuS banking trojan. The report provides timeline, C2 domains and IPs, file paths left on disk, persistence/startup entries, and recommended checks for affected users.