Recently, different threat intelligence forums have been reporting a number of public facing Pakistani websites being infected with sophisticated malware. These sophisticated malware mostly include banking trojans and information stealers and are found targeting the public sector. Most of these reported public websites are infected with the Emotet banking trojan. Secondly, Qakbot banking trojan was found on a considerable number of these websites.
While some public websites were infected with the AZORult information stealer, some of the reported public URLs are also infected with the Dridex banking trojan. It is recommended to immediately block all recent Indicators of Compromise associated with these malware. Moreover, as the trend of infections of public facing websites goes up, much caution is recommended while surfing the internet.
Find links to all relevant IoCs attached below in the remediation section.