RoughTed was a popular malvertising campaign with its first recorded sighting in 2017. RoughTed was able to evade several antivirus programs by continuously creating and changing new URLs, often through URL shorteners. The campaign leveraged the Content Delivery Network of Amazon’s cloud infrastructure and combined the noise with several redirections from ad networks. This made it extremely difficult to track and block the malicious websites the malvertising campaign was using to spread. RoughTed was also able to evade ad-blockers and used detailed fingerprinting of users. Users that visited compromised websites and had the requisite code were redirected to a tracking website once they clicked anywhere on the page.
The malicious sites used by this campaign distributed malware, fake updates embedded with adware and malicious browser extensions. RoughTed redirected traffic from streaming and file sharing sites through a series of intermediate sites to the Magnitude filtering gate and eventually led users to the exploit kit. RoughTed was estimated to have achieved over 500 million hits.