Terror Exploit Kit via Malvertising campaign

Terror Exploit Kit (EK) activity increased in recent malvertising campaigns that redirect users through fake ads to landing pages exploiting CVE-2016-0189 and CVE-2014-6332 and loading protected Flash (SWF) payloads; these chains delivered Smoke Loader downloader payloads. The report includes technical flow diagrams, notes use of SWF protection tools, sample MD5 hashes and malicious domains, and states ongoing monitoring by Zscaler ThreatLabZ.