Ongoing Angler Exploit Kit And Bedep Fraud Campaign

This report analyzes a Bedep malware campaign that leveraged the CVE-2015-0311 Flash exploit to install binaries which resolve DGA-generated domains using regway.com nameservers; researchers enumerated ~70+ malicious domains (many resolving to OVH-hosted IPs), multiple ASNs/netblocks, examples of C2 POSTs with base64 payloads, and use of the infrastructure for click-fraud and Reveton ransomware pages.