- Researchers find more than 150,000 compromised sites
- The sites that transported malware that overlooked them with malicious landing pages
- Web administrators are advised to revise their code
Security researchers C/Side recently reported on a larger cape campaign on the site where named threat players took over 35,000 sites and used them to redirect visitors to malicious pages and even serve them malware.
Now, a month later, the team has claimed that the campaign has been scaled further and is now compromising a staggering 150,000 sites.
C/Side believes that the campaign is related to Megalayer utilization as it is known for distributing Chinese-linguistic malware contains the same domain patterns and the same connectivity tactics.
Open Redirigations
While the method changed a bit and now comes with a “slightly renewed interface”, the core is still the same as attackers use IFRAME injections to show a full-screen overlay in visitors’ browser.
The overlayers show either mimic legitimate betting sites or directly false gambles.
C/page not detail who attackers are, except to say that they could be linked to the megal layer utilization.
The attackers are probably Chinese as they come from regions where Mandarin is common and as the final landing pages present game content under the Kaiyun brand.
They also did not discuss how the threat actors managed to compromise on these tens of thousands of websites, but when the striker gained access, they used it to inject a malicious script from a list of websites.
“When the manuscript is loaded, it fully hijacks the user’s browser window – often redirecting them to pages promoting a Chinese language game (or casino) platform,” the researchers explained in the previous report.
To mitigate the risk of takeover of sites, says C/Side Web Administrator[.]com, P11VT3[.]VIP and associated subdomains.
It would also be wise to keep an eye on logs for unexpected outgoing requests for these domains.