Hackers Attacks on Websites, the websites developed by a certain Korean company, have been the subject of assaults and have been used to spread malware. 

A wide range of businesses, including those in the manufacturing, trade, electrical, electronics, education, construction, medical, and tourism industries, have websites made by this particular website creation company.

The compromised websites were used to communicate information taken using web shells and to propagate malware, among other functions.

According to AhnLab Security Emergency Response Centre (ASEC), the first spread occurred via an email attachment.

Specifics of the Attack

According to reports, the compromised system is linked to the task scheduler, enabling the breach to occur continually.

If infected, the threat actor connects to a web shell that resembles the command listed in the task scheduler using the regular process mshta to take remote control of the victim’s PC. 

Task Scheduler Registration Script

Users may not be aware that they have been infected since the web shell URL used for remote control also utilizes the URL of a legitimate website that has already been compromised.

All domains used in this assault approach were verified to have been developed by the mentioned Korean website creation company. 

“The web shell URL required for remote control also uses the URL of the normal website that had already been breached, so it is difficult for users to realize that they have been infected,” researchers explain.

The domains also had an admin page that was reachable from the outside on the same path.

It is believed that the threat actor used this page to upload their malware.

“The findings from this recent incident reveal that a vulnerable website development company was the primary target of this attack,” researchers said.

“It shows that the websites created by this company are susceptible to exploitation by the RedEyes (APT37) threat group’s targeted attack”.

Earlier, the malware had been spread through scripts that were added to the websites of organizations and companies and placed in banner advertisements. 

Due to its security being less robust than the websites of organizations and businesses, the advertising firm was targeted in that event.

A possible danger of malware infection exists on websites developed by vulnerably sourced firms. For these reasons, it is essential to strengthen security precautions and carry out internal system audits.

Looking For an All-in-One Multi-OS Patch Management Platform – Try Patch Manager Plus