Loading threat actor…
YoSec is a malvertising threat actor associated with large-scale redirect campaigns in the online advertising ecosystem. The group has been described as operating from Eastern Europe and remained one of the more consistent malvertising actors through 2020, continuing activity into 2021. YoSec is notably linked to the distribution of the Shlayer trojan and to campaigns that pushed malicious applications, primarily against desktop users. The actor’s operations center on abusing ad-tech infrastructure to gain initial access through malicious or deceptive advertising placements, then executing forceful redirects from seemingly benign display ads to malware delivery pages. YoSec has used cloaking and other evasion methods to keep campaigns active while reducing detection, and has been observed smuggling redirect payloads behind legitimate-looking creatives. The group has also demonstrated browser-exploitation capability: a major 2020 campaign used JavaScript-based redirect logic that bypassed iframe sandbox protections in WebKit- and Chromium-based browsers, leading to fixes tracked as CVE-2021-1765 and CVE-2021-30533. YoSec fits the profile of a sophisticated criminal malvertising enterprise rather than a state-linked intrusion set. Its activity is characterized by persistent abuse of digital advertising channels for malware distribution, with emphasis on redirects, browser protection bypasses, defense evasion, and payload delivery at scale.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Jan. 22, 2021 — Apple issues Webkit fix, CVE-2021–1765 is assigned.
Mar. 1, 2021 — Patched in Chrome. May 24, 2021 — Chrome CVE-2021–30533 assigned.
18 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malvertising threat actor tied to activity clusters in ad networks, using common malvertising TTPs (redirects, cloaking, malicious landing pages).
Malvertising/redirect operator distributing macOS malware, notably acting as a major distribution source for Shlayer via redirects.
Malvertising threat actor identified by Confiant and tracked via the Malvertising Attack Matrix; associated with malicious advertising activity.
Named malvertising threat actor profile identified by Confiant and tracked via the Malvertising Attack Matrix.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.