Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
alt Hacker News
Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.