This will be a quick post as I just wanted to put out some updated IOCs.
Partial image of pre-filter page. Base64 string decodes to the RIG EK landing page.
HookAds is still pushing Dreambot via RIG EK.
← The Seamless Campaign Drops Ramnit. Follow-up Malware: AZORult Stealer, Smoke Loader, etc.