Skip to main content

Mysterious Javascript Code Found Infecting Hundreds of Websites

 



After installing Wappalyzer in my browser, I decided to test its functionality by visiting a familiar website. To my surprise, I was unexpectedly redirected to a spear phishing campaign. Knowing the website's usual practices, it seemed highly unlikely that they would intentionally redirect their visitors in such a manner. Intrigued by this anomaly, I took it upon myself to investigate the underlying cause of this redirection.

 

I have not yet known how threat actors implanted the Javascript Code in the victim's application but this is what it looked like.  

 

 

 

What does the code do?

 

The code is simply importing script from biggerfun[.]org domain. In other words, it's simply doing <script src="biggerfun[.]org"></script>


Further investigation


I wanted to check if others think the website is bad, so I looked into it more. I observed they do things similar to another group called TA569. You can learn more about TA569 here: https://www.proofpoint.com/us/blog/threat-insight/ta569-socgholish-and-beyond



How many hosts are infected?


Shodan results


 

Shodan requires some time for updates, and to the best of my knowledge, their scanners operate on IP addresses. Owing to vHosts, a single server can host multiple websites, all accessible from the same IP address, depending on the value of the HTTP Request header HOST. Hence, there should be more victims then the number shown by Shodan.

 

 

Analysis of threat actor's website

Malicious website: biggerfun[.]org

After bruteforcing the paths I found /admin

 

This could be a honeypot or a login page to their C2 dashboard.

 

Exposing more websites used in this campaign to host malicious Javascript code


1. emperorplan[.]org

2. catsndogz[.]org

3. treegreeny[.]org

4. cardladyjob[.]live

5. cjvdfw[.]com



 

 


Comments

Post a Comment

Popular posts from this blog

Typographical Errors | Diving Deep into Typographical Errors and Mistakes

Typographical Errors     Most of this blog was put together with the help of ChatGPT. This was put together to create a typographical error generator given any string.   What is a Typographical Error? A typographical error, commonly known as a "typo," is a mistake made in the typing or printing process of written material. These errors can arise from inadvertent keystrokes, inattention, or misjudgment during the editing phase. While they might seem minor, typos can sometimes alter the meaning of a sentence or lead to misunderstandings. They occur in various forms, including the omission, addition, transposition, or substitution of characters. With the advent of digital writing tools, auto-correct functions have also become a frequent source of unintentional typos. Regardless of their origin, it's essential for writers, editors, and publishers to thoroughly review content to ensure clarity and accuracy.   What are the types of Typographical Errors?   1. Substitut...
Post a Comment
Read more

Prevent account takeover with proper cookie configuration

    In this blog, I am writing about how improperly configured cookie may lead to account takeover. The type of account takeover I'm writing about is only possible when you're in the same local network as victim. Before explaining the issue, I want to thank Veshraj Ghimire for reviewing this.   Misconfiguration #1:  Not using 'secure' flag while setting cookies What is 'secure' flag? The secure flag is a setting that can be specified when a cookie is created and sent from a web server to a client browser. When a cookie is marked with the secure flag, the client browser will only transmit the cookie back to the server over a secure HTTPS connection. If the secure flag is not set, the cookie will be sent over both secure and insecure connections, making it vulnerable to eavesdropping and tampering by malicious actors.   Misconfiguration #2:  Cookie scoped to all the subdomains     What do I mean by "cookie scoped to all the subdomains"? If yo...
Post a Comment
Read more