Malvertising Targeting European Transit Users

ThreatLabZ identified a malvertising campaign targeting European transit users that deploys the KINS (Zeus-based) banking trojan; the report details redirection chains, example malicious URLs and ports, payload persistence locations, extensive registry modifications to disable security controls, network IOCs including a hard-coded User-Agent and POST to /common/link.php, decrypted C2 locations, and a listening TCP port (36139).