The problem was eventually traced back to the third-party advertising server Falk AG, which transmits advertising to websites that include The Register, NBC Universal, The Golf Channel and A&E Networks.
Also affected was NU.nl, the Netherlands’ largest news website with over 450,000 visitors each month.
According to Falk, the problem started around 6:10 p.m. GMT, when the company experienced an attack on one of its load balancers. Designed to evenly distribute requests to multiple servers, the balancer began to distribute about every 30th request to search.comedycentral.com, a compromised website that contained the Bofra/IFrame exploit.
“The purpose of the exploit was to establish a redirect to malicious code through a javascript component of Falk’s ad delivery,” Falk told its customers. The total amount of redirects were only 2 percent of EU ad requests, the company said.
LURHQ Threat Intelligence Group reported that at least two different Trojans were being installed by during the six hours that the compromised advertisements were being served. Infamous adware Trojan Virtumonde and backdoor downloader Trojan.Agent.EC were both fingered in the attacks.
Both programs use the IFrame exploit, discovered in late October and applicable to all Windows platforms except Windows XP Service Pack 2.