Wednesday, December 6, 2023

Hackers Attacks on Websites Developed by a Specific Website Development Company

Hackers Attacks on Websites, the websites developed by a certain Korean company, have been the subject of assaults and have been used to spread malware. 

A wide range of businesses, including those in the manufacturing, trade, electrical, electronics, education, construction, medical, and tourism industries, have websites made by this particular website creation company.

The compromised websites were used to communicate information taken using web shells and to propagate malware, among other functions.

According to AhnLab Security Emergency Response Centre (ASEC), the first spread occurred via an email attachment.

Specifics of the Attack

According to reports, the compromised system is linked to the task scheduler, enabling the breach to occur continually.

If infected, the threat actor connects to a web shell that resembles the command listed in the task scheduler using the regular process mshta to take remote control of the victim’s PC. 

Task Scheduler Registration Script

Users may not be aware that they have been infected since the web shell URL used for remote control also utilizes the URL of a legitimate website that has already been compromised.

All domains used in this assault approach were verified to have been developed by the mentioned Korean website creation company

“The web shell URL required for remote control also uses the URL of the normal website that had already been breached, so it is difficult for users to realize that they have been infected,” researchers explain.

The domains also had an admin page that was reachable from the outside on the same path.

It is believed that the threat actor used this page to upload their malware.

“The findings from this recent incident reveal that a vulnerable website development company was the primary target of this attack,” researchers said.

“It shows that the websites created by this company are susceptible to exploitation by the RedEyes (APT37) threat group’s targeted attack”.

Earlier, the malware had been spread through scripts that were added to the websites of organizations and companies and placed in banner advertisements. 

Due to its security being less robust than the websites of organizations and businesses, the advertising firm was targeted in that event.

A possible danger of malware infection exists on websites developed by vulnerably sourced firms. For these reasons, it is essential to strengthen security precautions and carry out internal system audits.

Looking For an All-in-One Multi-OS Patch Management Platform – Try Patch Manager Plus

Website

Latest articles

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

Serpent Stealer Acquires Browser Passwords and Erases Intrusion Logs

Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision...

Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

It has been observed that threat actors are using AI technology to conduct illicit...

Kali Linux 2023.4 Released – What’s New!

Kali Linux 2023.4, the latest version of Offensive Security's renowned operating system, has been...

Trickbot Malware Developer Pleads Guilty & Faces 35 Years in Prison

A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware....

ICANN Launches RDRS to Assist Law Enforcement Agencies to Discover Private Info

ICANN is a non-profit organization that is responsible for coordinating the global internet's-DNSIP address...

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles