Rewterz Threat Alert – Malware Leveraging XML-RPC Vulnerability to Exploit WordPress Sites
September 17, 2020Rewterz Threat Advisory – Linux Kernel vgacon_scrolldelta information disclosure
September 18, 2020Severity
High
Analysis Summary
Recently, different threat intelligence forums have been reporting a number of public facing Pakistani websites being infected with sophisticated malware. These sophisticated malware mostly include banking trojans and information stealers and are found targeting the public sector. Most of these reported public websites are infected with the Emotet banking trojan. Secondly, Qakbot banking trojan was found on a considerable number of these websites.
While some public websites were infected with the AZORult information stealer, some of the reported public URLs are also infected with the Dridex banking trojan. It is recommended to immediately block all recent Indicators of Compromise associated with these malware. Moreover, as the trend of infections of public facing websites goes up, much caution is recommended while surfing the internet.
Impact
- Information Theft
- Theft of Financial Information
- Data Exfiltration
- Files Encryption
- Financial Loss
- Confidentiality Breach
- Network-wide Infection
Indicators of Compromise
Find links to all relevant IoCs attached below in the remediation section.
Remediation
- Strictly avoid visiting untrusted websites and URLs and do not click on Ads or links if not necessary.
- Block all IoCs related to the above mentioned malware. IoCs can be found at links given below.