Wiz Details Campaign Hijacking Thousands of Websites to Redirect East Asian Visitors

Mar 2, 2023 · Original article ↗

Summary

Wiz researchers estimated that an unknown actor compromised at least 10,000 websites, mainly targeting East Asian audiences, and used injected JavaScript to redirect some visitors. The initial access method and the actor’s precise motives remain unknown.

Key points

Wiz estimated at least 10,000 websites had been compromised since early September 2022, based on publicwww and SimilarWeb data; the sites redirected hundreds of thousands of users monthly.
In investigated cases, the actor accessed FTP endpoints with legitimate credentials. A Wiz honeypot saw connections from 172.81.104[.]64, but researchers could not determine how credentials were obtained or establish a single initial access method.
The actor injected JavaScript tags or code into website files. Scripts used geofencing, crawler and search-engine filtering, and probabilistic redirects to adult or gambling content.
Earlier script variants collected visitor and browser details and sent them to an actor-controlled API; that behavior was absent from variants observed since December 2022.
After related samples were detected by a YARA rule in late November 2022, the actor began directly injecting obfuscated JavaScript in some cases. Researchers said this may have been a response, but could not rule out coincidence.
Researchers observed no evidence of phishing, web skimming, or malware infection, and could not establish the actor’s exact motive or initial access vector.
Wiz recommended rotating affected credentials, switching to FTPS or SFTP, removing injected code, and restoring clean assets; it also shared findings with Cloudflare and requested that it block the redirects.

Article Details

Attack Vectors: The unknown actor accessed web servers through FTP using legitimate credentials; the source does not establish how those credentials were obtained.
After access, the actor modified website files to add JavaScript tags or injected obfuscated JavaScript directly into existing files.
Visitors to compromised websites could have the script execute in their browsers and be conditionally redirected, based on factors including geography and a probability setting.
Earlier script variants collected visitor browser and environment information and sent it in a Base64-encoded JSON payload via HTTP POST to an attacker-controlled endpoint.
Defensive Notes: Use FTPS or SFTP with strong credentials for website maintenance.
Rotate FTP and Git credentials associated with affected websites.
Search website assets for known malicious domains and JavaScript tags or code; remove the malicious code or restore clean asset versions.
Redeploy servers from a trusted image when possible, reinstall software from a trusted source, and patch to the latest version.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`22332299[.]com`	Destination domain used in the activity’s redirects to adult-themed content.
DOMAIN	`3h1yt68lxk[.]com`	Dynamically named domain listed as a redirect destination in the activity.
DOMAIN	`a[.]msstatic[.]net`	Host serving an injected JavaScript payload on compromised Pagoda servers.
DOMAIN	`alibb1[.]xyz`	Destination domain used in the activity’s redirects to adult-themed content.
DOMAIN	`alibb2[.]xyz`	Destination domain used in the activity’s redirects to adult-themed content.
DOMAIN	`alivod1[.]com`	Destination domain used in the activity’s redirects to adult-themed content.
DOMAIN	`beacon-v2[.]helpscout[.]help`	Host identified as serving a malicious JavaScript variant while masquerading as a legitimate Help Scout URL.
DOMAIN	`cdn-go[.]net`	Host identified as serving a malicious JavaScript variant while masquerading as a legitimate URL.
DOMAIN	`cdn[.]jsdelivr[.]autos`	Host identified as serving a malicious JavaScript variant while masquerading as a jsDelivr URL.
DOMAIN	`g7h69h29cx[.]com`	Dynamically named redirect destination associated with the activity.
DOMAIN	`minjs[.]us`	Host identified as serving a malicious JavaScript variant.
DOMAIN	`qs70qw11az[.]com`	Dynamically named redirect destination displaying Alibbfb branding and gambling advertisements.
DOMAIN	`rsoy6a1w7p[.]com`	Dynamically named domain listed as a redirect destination in the activity.
DOMAIN	`s3a[.]pstatp[.]org`	Intermediate redirect host identified as part of the malicious redirection flow.
DOMAIN	`stat[.]51sdk[.]org`	Intermediate redirect host identified as part of the malicious redirection flow.
DOMAIN	`tpc[.]cdn-linkedin[.]info`	Intermediate redirect host masquerading as a LinkedIn CDN URL.
DOMAIN	`tpc[.]googlesyndication[.]wiki`	Attacker-controlled host serving the injected JavaScript payload while masquerading as tpc.googlesyndication.com.
DOMAIN	`widget-v4[.]tidiochat[.]net`	Intermediate redirect host identified as part of the malicious redirection flow.
DOMAIN	`www[.]metamarket[.]quest`	Host serving a malicious redirection script; the article links its infrastructure to other domains in the activity.
IPV4	`159[.]69[.]123[.]158`	Historical origin IP exposed for www.metamarket[.]quest, a host identified as serving a malicious script.
IPV4	`172[.]81[.]104[.]64`	Static source IP observed connecting to the researchers’ honeypot and to FTP endpoints involved in the activity.
IPV4	`193[.]109[.]120[.]45`	Historical origin IP exposed for minjs[.]us, a host identified as serving a malicious script.
SHA256	`08d6092832ab0631cb45415707fe6e262a205d1809a064ed9aa577647a39ba8e`	Hash of a known sodar2.js sample associated with the malicious scripts.
SHA256	`0a1cecea008b34bcbc8db9f4f56077a02492b3970cfe59fd8e96a08655c81cc2`	Hash of a known min.js sample associated with the malicious scripts.
SHA256	`30ec43c09bc09a4224001acb4af67126d5f2c58a2120c3e9f606c719ab6c826b`	Hash of a known jquery.min.js sample associated with the malicious scripts.
SHA256	`4770fdd231dccd6775a561fbf9c9dc16c0009aaea934107f5d7e9a79e10295d7`	Hash of a known market.js sample associated with the malicious scripts.
SHA256	`50bf3385e888eee5e31a92d71c9a194b3bdfb62760b9cc069b962ef9d3b5646f`	Hash of a known vendor.06c7227b.js sample associated with the malicious scripts.
SHA256	`76acbfd3312024f2c3046ead1c6da8d1bb832cb9e71fe74a4977f9e30067cfb3`	Hash of a known ad.tmpl_a9b7.js sample associated with the malicious scripts.
SHA256	`a39970152a2d753c4fb449b15617820c72d02c3489f99155131f68376edc714e`	Hash of a systemd-private-named file retrieved from infected Pagoda servers and associated with the activity.
SHA256	`abdf025595c1e544d7a33432d4a8b2ed0a0170bc4d1657312396e14d277dc2d1`	Hash of a modified NGINX binary retrieved from infected Pagoda servers.