- Godaddy found a malicious campaign that infected 20,000 WordPress -Webot
- It’s called Dollyway and it’s super sustained
- Dollyway redirects visitors to fake game and cryptosides
A prolonged, super sustained malicious campaign that infected more than 20,000 WordPress sites around the world has been revealed by experts.
Godaddy security researchers called it “Dollyway World Domination,” which had the goal of redirecting vicims for fake dating, games, crypto and competitions, although the campaign in the past was also used to spread ransomware and bank faiths.
Dollyway has been active since at least 2016, says Godaddy, and added today that it generates 10 million impressions each month and raker in solid earnings for operators. Over the years, it also improved strategies for evasion, reinfection and revenue generation.
A single threat actor
Dollyway is currently in its third iteration, while the previous ones were more focused on malware -distribution and phishing.
To compromise on WordPress sites, Dollyways operators looked after N-day vulnerabilities in plugins and themes for the platform. They also used a Traffic Direction System (TD) to filter and redirect users based on their location, device and referral. To ensure that attackers are paid per Redirecting, they used VexTrio and Lospollos networks.
When it comes to blurring, Dollyway did a number of things: It only redirected users after they clicked on something to avoid passive security scans. Nor did it divert any logged WordPress users, bots and direct visitors who came without referrers. It was also quite persistent, said Godaddy, as reinfection would occur with each side load.
First, Godaddy’s researchers were under the impression that they were analyzing several groups and different campaigns.
“Although it was previously assumed to be separate campaigns, our research reveals that these attacks share common infrastructure, code patterns and income methods – all appear to be associated with a single, sophisticated threat actor,” the researchers concluded. “The operation was named after the following narrative of narrative found in some variations of malware: Define (‘Dolly_way’, ‘World Domination’).”
Via Bleeping computer
