Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service

A new traffic direction system (TDS) called Parrot has been spotted leveraging tens of thousands of compromised websites to launch further malicious campaigns.

„The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites,” Avast researchers Pavel Novák and Jan Rubín said in a report published last week.

Traffic direction systems are used by threat actors to determine whether or not a target is of interest and should be redirected to a malicious domain under their control and act as a gateway to compromise their systems with malware.

Earlier this January, the BlackBerry Research and Intelligence Team detailed another TDS called Prometheus that has been put to use in different campaigns mounted by cybercriminal groups to distribute Campo Loader, Hancitor, IcedID, QBot, Buer Loader, and SocGholish malware.

What makes Parrot TDS stand out is its huge reach, with increased activity observed in February and March 2022, as its operators have primarily singled out servers hosting poorly secured WordPress sites to gain administrator access.

Most of the users targeted by these malicious redirects are located in Brazil, India, the U.S, Singapore, Indonesia, Argentina, France, Mexico, Pakistan, and Russia.

„The infected sites’ appearances are altered by a campaign called FakeUpdate (also known as SocGholish), which uses JavaScript to display fake notices for users to update their browser, offering an update file for download,” the researchers said. „The file observed being delivered to victims is a remote access tool.”

Parrot TDS, via an injected PHP script hosted on the compromised server, is designed to extract client information and forward the request to the command-and-control (C2) server upon visiting one of the infected sites, in addition to allowing the attacker to perform arbitrary code execution on the server.

The response from the C2 server takes the form of JavaScript code that’s executed on the client machine, exposing the victims to potential new threats. Also observed alongside the malicious backdoor PHP script is a web shell that grants the adversary persistent remote access to the web server.

Calling the criminal actors behind the FakeUpdate campaign a prevalent customer of Parrot TDS, Avast said the attacks involved prompting users to download malware under the guise of rogue browser updates, a remote access trojan named „ctfmon.exe” that gives the attacker full access to the host.

Podziel się postem:

Najnowsze:

Bezpieczeństwo

IYPS – Czy Twoje hasło jest bezpieczne? Aplikacja, która sprawdza bezpieczeństwo haseł

W dzisiejszych czasach, kiedy coraz więcej aspektów naszego życia przenosi się do sieci, bezpieczeństwo online staje się priorytetem. Jednym z najważniejszych elementów tego bezpieczeństwa są silne i unikalne hasła. Ale jak sprawdzić, czy nasze hasła są rzeczywiście bezpieczne? Z pomocą przychodzi aplikacja IYPS – Is Your Password Secure?

Sprzęt

RTX 5090 z rekordową przepustowością pamięci

Według najnowszych doniesień Nvidia wybrała pamięć GDDR7 firmy Samsung jako preferowaną pamięć dla nadchodzącej serii kart graficznych GeForce RTX 50 “Blackwell”. Choć nie ma oficjalnego potwierdzenia, przeciek głosi, że ma być ona wykorzystana w produktach, które wejdą na rynek w 2025 roku.

Oprogramowanie

Oficjalnie wydano jądro Linux 6.12. Oto nowości

W tej wersji wprowadzono obsługę „PREEMPT_RT” w czasie rzeczywistym, nowy harmonogram o nazwie sched_ext oraz komunikaty alarmowe DRM w postaci kodów QR.

Dodaj komentarz

Twój adres e-mail nie zostanie opublikowany. Wymagane pola są oznaczone *