New ‘Beladen’ threat infecting 40,000 websites
Security vendors suspect it might be the work of cybercriminal gang ‘The Russian Business Network’.
Websense has dubbed the threat Beladen', as this is the name of the exploit site that the obfuscated code ultimately redirects unwitting users to from the legitimate website.
Beladen.net is full of various attacks and after a successful exploitation, a malicious file will be run on the infected computer.
The exploit also uses the typo-squatter' domain with a similar name to the legitimate Google Analytics domain (google-analytics.com), redirecting users to beladen.net.
Speaking to IT PRO, threat research manager Carl Leonard said he believed that the attackers were using an automated tool to find vulnerable sites to inject code into, and that it was a big increase for such a short period of time.
He said: "Right now we're seeing it increasing on a daily basis. This one is particularly interesting because it's sites that have been quiet for a while.
"Beladen.net has been known to us for quite some time, and suddenly it has woken up and is now hosting these exploits."
Leonard said that this attack showed similarities to previous attacks carried out by organised cybercriminals the Russian Business Network' (RBN) in the past.
He said: "In the security industry we thought that the RBN had died out. It might be a copycat replicating some of the activities, or it could be a group within that team who are now reactivating and injecting further sites."
Websense didn't believe that it was related to the Gumblar' threat reported by IT PRO last May, which Sophos claimed was the [a href="
http://www.itpro.co.uk/610878/researchers-discover-the-biggest-web-malware-threat" target="_blank"]biggest web malware threat'[/a].
Beladen also had a low anti-virus detection rate. Leonard said that at the time the attack was first reported, only four out of 40 anti-virus vendors had reported the threat.
He also said that if an exploit didn't work on a machine, the attack would also try to download rogue anti-virus software, in order to dupe users in downloading a trojan.
Key considerations for implementing secure telework at scale
Identifying the security risks and advanced requirements of a remote workforceDownload now
The State of Salesforce 2020
Your guide to getting the most from SalesforceDownload now
Fast, flexible and compliant e-signatures for global businesses
Be at the forefront of digital transformation with electronic signaturesDownload now
Rethink your cybersecurity strategy for the new world
5 steps to secure the enterprise and be fit for a flexible futureDownload now