Music-themed Malvertising Lead To Angler

This report describes a malvertising campaign (early 2016) that injected malicious iframes into OpenX/OpenAds banner advertisements, using intermediary "iframe trampoline" music-themed domains that redirected to the Angler Exploit Kit landing page. The campaign affected hundreds of domains (notably radio stations and auto forums), used two IP addresses and numerous subdomains, and includes indicators of compromise (domains, IPs, WHOIS samples and pastebin lists).