Malvertising Campaign Leading To Zemot

A widespread malvertising campaign abuses Zedo ad placements to redirect victims through obfuscated domains to a Swedish geobalancer and ultimately to a site serving the Nuclear Exploit Kit, which drops a Zemot payload via a Kuluoz variant. Zscaler observed multiple legitimate sites compromised and reports an IOC of a temporary batch file (e.g., C:\Users\WIN7\AppData\Local\Temp\tmp37cd8110.bat).