Neutrino Malvertising campaign drops Gamarue

Neutrino Exploit Kit (EK) malvertising campaigns have recently increased, using advertising networks to serve iframe chains that deliver a Flash-based Neutrino landing page which exploits Flash to drop a packed Gamarue/Andromeda payload. The report describes the infection chain, Gamarue's modular downloader behavior and sandbox-evasion (including a volume-serial-based registration and registry bypass), and lists multiple advertising hosts, landing/callback domains, IPs, and file hashes as IOCs.