Rewterz Threat Alert – Recent Wave of Sophisticated Malware Infecting Public Facing Websites

Severity

High

Analysis Summary

Recently, different threat intelligence forums have been reporting a number of public facing Pakistani websites being infected with sophisticated malware. These sophisticated malware mostly include banking trojans and information stealers and are found targeting the public sector. Most of these reported public websites are infected with the Emotet banking trojan. Secondly, Qakbot banking trojan was found on a considerable number of these websites.

While some public websites were infected with the AZORult information stealer, some of the reported public URLs are also infected with the Dridex banking trojan. It is recommended to immediately block all recent Indicators of Compromise associated with these malware. Moreover, as the trend of infections of public facing websites goes up, much caution is recommended while surfing the internet. 

Impact

• Information Theft
• Theft of Financial Information
• Data Exfiltration
• Files Encryption
• Financial Loss
• Confidentiality Breach
• Network-wide Infection

Indicators of Compromise

Find links to all relevant IoCs attached below in the remediation section.

Remediation

• Strictly avoid visiting untrusted websites and URLs and do not click on Ads or links if not necessary.
• Block all IoCs related to the above mentioned malware. IoCs can be found at links given below.

Emotet IoCs

AZORult IoCs

Qakbot IoCs

Dridex IoCs