Security News > 2022 > April > Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service

"The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites," Avast researchers Pavel Novák and Jan Rubín said in a report published last week.

Earlier this January, the BlackBerry Research and Intelligence Team detailed another TDS called Prometheus that has been put to use in different campaigns mounted by cybercriminal groups to distribute Campo Loader, Hancitor, IcedID, QBot, Buer Loader, and SocGholish malware.

What makes Parrot TDS stand out is its huge reach, with increased activity observed in February and March 2022, as its operators have primarily singled out servers hosting poorly secured WordPress sites to gain administrator access.

Parrot TDS, via an injected PHP script hosted on the compromised server, is designed to extract client information and forward the request to the command-and-control server upon visiting one of the infected sites, in addition to allowing the attacker to perform arbitrary code execution on the server.

Also observed alongside the malicious backdoor PHP script is a web shell that grants the adversary persistent remote access to the web server.

Calling the criminal actors behind the FakeUpdate campaign a prevalent customer of Parrot TDS, Avast said the attacks involved prompting users to download malware under the guise of rogue browser updates, a remote access trojan named "Ctfmon.exe" that gives the attacker full access to the host.

News URL

https://thehackernews.com/2022/04/over-16500-sites-hacked-to-distribute.html