Catching MCAs at the Intersection of Infrastructure and Influence
The intersection of infrastructure and influence creates linkages which may become discoverable and aid cyber defenders in catching MCAs.
Compromised websites are a common attack vector for Malicious Cyber Actors, as there are often multiple vulnerabilities which are easily exploited. Compromised websites are a common attack vector used by threat actors to serve any number of threats – malware, viruses, phishing, ransomware, etc.
Network Security, Malicious Threats, and Common Computer Definitions
We’ve put together this glossary of cyber threat definitions as a resource for you in your quest to help make the internet a safer place for all!
WaterHole Attacks – Compromised Websites
Instances of large-scale compromises of both private industry and public institutions in 2013 prompted a flurry of activity among security researchers to identify emerging and established threats. Commonly identified as Advance Persistent Threats (APTs), this phenomenon is expected to continue well into the foreseeable future. Fundamental to the spread of these threats is one of their foremost methods of propagation – a water hole attack.
135,000 Fake YouTube Pages Delivering Malware
zveloLABS™ has uncovered thousands of compromised web servers hosting fake YouTube pages. Attempting to play the video on these fake pages prompts the user to install a ‘media codec’ which then infects the machine with malware.
Japanese Hosting Site Compromised
zveloLABS™ is today warning users to be wary of sites hosted on g0oo.info, a Japanese hosting site. At this time, all blogs and other web sites hosted by g0oo.info are compromised and currently being used to boost the Google PageRank of various sites including Japanese pornography sites in a technique sometimes called “PageRank Bombing” and also referred to as “BlackHat SEO.”
Update on Fox Sports Website Infection
Quick update on this web threat: as of today, 10/7/09, the Fox Sports website is still compromised. The specific URL, hxxp://msndr.foxsports.com/, has been cleaned, but any added nonsensical path results in a 404 page with the malicious iframe to thingre.com.