New ‘Beladen’ threat infecting 40,000 websites

Security vendors suspect it might be the work of cybercriminal gang ‘The Russian Business Network’.

The number of legitimate websites now compromised around the world by a malicious Javascript injection is now at 40,000 and growing.

This was according to the security vendor Websense, which originally alerted last Friday that only around 20,000 had been compromised, meaning the infection has doubled in size in only a few days.

Websense has dubbed the threat Beladen', as this is the name of the exploit site that the obfuscated code ultimately redirects unwitting users to from the legitimate website.

Beladen.net is full of various attacks and after a successful exploitation, a malicious file will be run on the infected computer.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The exploit also uses the typo-squatter' domain with a similar name to the legitimate Google Analytics domain (google-analytics.com), redirecting users to beladen.net.

Speaking to IT PRO, threat research manager Carl Leonard said he believed that the attackers were using an automated tool to find vulnerable sites to inject code into, and that it was a big increase for such a short period of time.

He said: "Right now we're seeing it increasing on a daily basis. This one is particularly interesting because it's sites that have been quiet for a while.

"Beladen.net has been known to us for quite some time, and suddenly it has woken up and is now hosting these exploits."

Leonard said that this attack showed similarities to previous attacks carried out by organised cybercriminals the Russian Business Network' (RBN) in the past.

He said: "In the security industry we thought that the RBN had died out. It might be a copycat replicating some of the activities, or it could be a group within that team who are now reactivating and injecting further sites."

Advertisement - Article continues below

Websense didn't believe that it was related to the Gumblar' threat reported by IT PRO last May, which Sophos claimed was the [a href="

http://www.itpro.co.uk/610878/researchers-discover-the-biggest-web-malware-threat" target="_blank"]biggest web malware threat'[/a].

Beladen also had a low anti-virus detection rate. Leonard said that at the time the attack was first reported, only four out of 40 anti-virus vendors had reported the threat.

He also said that if an exploit didn't work on a machine, the attack would also try to download rogue anti-virus software, in order to dupe users in downloading a trojan.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

23 Dec 2019
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/security/cyber-security/354468/if-not-passwords-then-what
cyber security

If not passwords then what?

8 Jan 2020
Visit/policy-legislation/31772/gdpr-and-brexit-how-will-one-affect-the-other
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020