Wednesday, April 30, 2025
HomeCyber AttackHackers Attacks on Websites Developed by a Specific Website Development Company

Hackers Attacks on Websites Developed by a Specific Website Development Company

Published on

SIEM as a Service

Follow Us on Google News

Hackers Attacks on Websites, the websites developed by a certain Korean company, have been the subject of assaults and have been used to spread malware. 

A wide range of businesses, including those in the manufacturing, trade, electrical, electronics, education, construction, medical, and tourism industries, have websites made by this particular website creation company.

The compromised websites were used to communicate information taken using web shells and to propagate malware, among other functions.

- Advertisement - Google News

According to AhnLab Security Emergency Response Centre (ASEC), the first spread occurred via an email attachment.

Specifics of the Attack

According to reports, the compromised system is linked to the task scheduler, enabling the breach to occur continually.

If infected, the threat actor connects to a web shell that resembles the command listed in the task scheduler using the regular process mshta to take remote control of the victim’s PC. 

Task Scheduler Registration Script

Users may not be aware that they have been infected since the web shell URL used for remote control also utilizes the URL of a legitimate website that has already been compromised.

All domains used in this assault approach were verified to have been developed by the mentioned Korean website creation company

“The web shell URL required for remote control also uses the URL of the normal website that had already been breached, so it is difficult for users to realize that they have been infected,” researchers explain.

The domains also had an admin page that was reachable from the outside on the same path.

It is believed that the threat actor used this page to upload their malware.

“The findings from this recent incident reveal that a vulnerable website development company was the primary target of this attack,” researchers said.

“It shows that the websites created by this company are susceptible to exploitation by the RedEyes (APT37) threat group’s targeted attack”.

Earlier, the malware had been spread through scripts that were added to the websites of organizations and companies and placed in banner advertisements. 

Due to its security being less robust than the websites of organizations and businesses, the advertising firm was targeted in that event.

A possible danger of malware infection exists on websites developed by vulnerably sourced firms. For these reasons, it is essential to strengthen security precautions and carry out internal system audits.

Looking For an All-in-One Multi-OS Patch Management Platform – 

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...

Researchers Reveal Threat Actor TTP Patterns and DNS Abuse in Investment Scams

Cybersecurity researchers have uncovered the intricate tactics, techniques, and procedures (TTPs) employed by threat...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...