Thursday, October 3, 2024
HomeCyber AttackHackers Attacks on Websites Developed by a Specific Website Development Company

Hackers Attacks on Websites Developed by a Specific Website Development Company

Published on

Hackers Attacks on Websites, the websites developed by a certain Korean company, have been the subject of assaults and have been used to spread malware. 

A wide range of businesses, including those in the manufacturing, trade, electrical, electronics, education, construction, medical, and tourism industries, have websites made by this particular website creation company.

The compromised websites were used to communicate information taken using web shells and to propagate malware, among other functions.

- Advertisement - EHA

According to AhnLab Security Emergency Response Centre (ASEC), the first spread occurred via an email attachment.

Specifics of the Attack

According to reports, the compromised system is linked to the task scheduler, enabling the breach to occur continually.

If infected, the threat actor connects to a web shell that resembles the command listed in the task scheduler using the regular process mshta to take remote control of the victim’s PC. 

Task Scheduler Registration Script

Users may not be aware that they have been infected since the web shell URL used for remote control also utilizes the URL of a legitimate website that has already been compromised.

All domains used in this assault approach were verified to have been developed by the mentioned Korean website creation company

“The web shell URL required for remote control also uses the URL of the normal website that had already been breached, so it is difficult for users to realize that they have been infected,” researchers explain.

The domains also had an admin page that was reachable from the outside on the same path.

It is believed that the threat actor used this page to upload their malware.

“The findings from this recent incident reveal that a vulnerable website development company was the primary target of this attack,” researchers said.

“It shows that the websites created by this company are susceptible to exploitation by the RedEyes (APT37) threat group’s targeted attack”.

Earlier, the malware had been spread through scripts that were added to the websites of organizations and companies and placed in banner advertisements. 

Due to its security being less robust than the websites of organizations and businesses, the advertising firm was targeted in that event.

A possible danger of malware infection exists on websites developed by vulnerably sourced firms. For these reasons, it is essential to strengthen security precautions and carry out internal system audits.

Looking For an All-in-One Multi-OS Patch Management Platform – 

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Northern Ireland Police to Pay £750,000 Fine Following Data Breach

The Police Service of Northern Ireland (PSNI) has been ordered to pay a £750,000...

ANY.RUN Upgrades Threat Intelligence to Identify Emerging Threats

ANY.RUN announced an upgrade to its Threat Intelligence Portal, enhancing its capabilities to identify...

Cisco Nexus Vulnerability Let Hackers Execute Arbitrary Commands on Vulnerable Systems

A critical vulnerability has been discovered in Cisco's Nexus Dashboard Fabric Controller (NDFC), potentially...

Hackers Now Exploit Ivanti Endpoint Manager Vulnerability to Launch Cyber Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of a new...

Free Webinar

Decoding Compliance | What CISOs Need to Know

Non-compliance can result in substantial financial penalties, with average fines reaching up to $4.5 million for GDPR breaches alone.

Join us for an insightful panel discussion with Chandan Pani, CISO - LTIMindtree and Ashish Tandon, Founder & CEO – Indusface, as we explore the multifaceted role of compliance in securing modern enterprises.

Discussion points

The Role of Compliance
The Alphabet Soup of Compliance
Compliance
SaaS and Compliance
Indusface's Approach to Compliance

More like this

Northern Ireland Police to Pay £750,000 Fine Following Data Breach

The Police Service of Northern Ireland (PSNI) has been ordered to pay a £750,000...

Cisco Nexus Vulnerability Let Hackers Execute Arbitrary Commands on Vulnerable Systems

A critical vulnerability has been discovered in Cisco's Nexus Dashboard Fabric Controller (NDFC), potentially...

Hackers Now Exploit Ivanti Endpoint Manager Vulnerability to Launch Cyber Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of a new...