Hackers Attacks on Websites Developed by a Specific Website Development Company

Hackers Attacks on Websites, the websites developed by a certain Korean company, have been the subject of assaults and have been used to spread malware. 

A wide range of businesses, including those in the manufacturing, trade, electrical, electronics, education, construction, medical, and tourism industries, have websites made by this particular website creation company.

The compromised websites were used to communicate information taken using web shells and to propagate malware, among other functions.

According to AhnLab Security Emergency Response Centre (ASEC), the first spread occurred via an email attachment.

Specifics of the Attack

According to reports, the compromised system is linked to the task scheduler, enabling the breach to occur continually.

If infected, the threat actor connects to a web shell that resembles the command listed in the task scheduler using the regular process mshta to take remote control of the victim’s PC. 

Task Scheduler Registration Script

Users may not be aware that they have been infected since the web shell URL used for remote control also utilizes the URL of a legitimate website that has already been compromised.

All domains used in this assault approach were verified to have been developed by the mentioned Korean website creation company

“The web shell URL required for remote control also uses the URL of the normal website that had already been breached, so it is difficult for users to realize that they have been infected,” researchers explain.

The domains also had an admin page that was reachable from the outside on the same path.

It is believed that the threat actor used this page to upload their malware.

“The findings from this recent incident reveal that a vulnerable website development company was the primary target of this attack,” researchers said.

“It shows that the websites created by this company are susceptible to exploitation by the RedEyes (APT37) threat group’s targeted attack”.

Earlier, the malware had been spread through scripts that were added to the websites of organizations and companies and placed in banner advertisements. 

Due to its security being less robust than the websites of organizations and businesses, the advertising firm was targeted in that event.

A possible danger of malware infection exists on websites developed by vulnerably sourced firms. For these reasons, it is essential to strengthen security precautions and carry out internal system audits.

Looking For an All-in-One Multi-OS Patch Management Platform – 

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Landmark Admin Suffers Major Breach, Exposing Data of 1.6M+ Users

Landmark Admin, LLC (“Landmark”), a Texas-based third-party administrator for life insurance carriers, has confirmed that…

1 hour ago

SquareX to Reveal Critical Data Splicing Attack at BSides SF, Exposing Major DLP Vulnerability

SquareX researchers Jeswin Mathai and Audrey Adeline will be disclosing a new class of data exfiltration techniques at BSides San…

1 hour ago

Firefox Fixes High-Severity Vulnerability Causing Memory Corruption via Race Condition

Mozilla has released Firefox 137.0.2, addressing a high-severity security flaw that could potentially allow attackers…

3 hours ago

Tails 6.14.2 Released with Critical Fixes for Linux Kernel Vulnerabilities

The Tails Project has urgently released Tails 6.14.2, addressing critical security vulnerabilities in the Linux kernel…

4 hours ago

APT29 Hackers Use GRAPELOADER in New Attack Against European Diplomats

Check Point Research (CPR) has uncovered a new targeted phishing campaign employing GRAPELOADER, a sophisticated…

5 hours ago

Chinese Hackers Unleash New BRICKSTORM Malware to Target Windows and Linux Systems

A sophisticated cyber espionage campaign leveraging the newly identified BRICKSTORM malware variants has targeted European…

5 hours ago