Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An investigation into VexTrio, a malicious traffic distribution system (TDS), revealed surprising connections between WordPress hackers and adtech companies. When VexTrio's operations were disrupted, multiple malware actors migrated to a new TDS that was discovered to be related to VexTrio. Several commercial TDSs were found to share software elements with VexTrio and benefit from its relationship with website malware actors. The investigation uncovered a complex network of adtech firms, including Partners House, BroPush, and RichAds, that use similar technologies and tactics to distribute malicious content. These firms have information about the identities of malware actors, which could potentially lead to their disruption.

The threat revolves around VexTrio, a malicious Traffic Distribution System (TDS) that operates by redirecting web traffic to deliver malware and other malicious payloads. VexTrio has been linked to a network of WordPress hackers who compromise websites to inject malicious code, which then funnels visitors through the TDS infrastructure. When VexTrio's operations were disrupted, malware actors migrated to a successor TDS sharing code and operational tactics with VexTrio, indicating a resilient and adaptive threat ecosystem. The investigation uncovered that several commercial adtech firms, including Partners House, BroPush, and RichAds, share software components and methodologies with VexTrio, blurring the lines between legitimate advertising technology and malicious activity. These adtech companies leverage push notifications, DNS manipulation, and affiliate networks to distribute malicious content, exploiting the trust and reach of advertising platforms. The relationship between these adtech firms and malware actors is complex, with the adtech companies possessing detailed information about the identities of malware operators, potentially enabling law enforcement or security researchers to disrupt these networks. The threat employs multiple tactics and techniques as categorized by MITRE ATT&CK, including command and control over web protocols (T1071), exploitation of public-facing applications (T1190), use of affiliate networks (T1608), and social engineering via push notifications (T1204). The lack of known exploits in the wild suggests that the threat is more focused on distribution and persistence rather than zero-day exploitation. Overall, this threat represents a sophisticated convergence of cybercrime and adtech ecosystems, leveraging compromised WordPress sites and advertising infrastructure to propagate malware at scale.

Detailed information about What is the Real Relationship between WordPress Hackers and Malicious Adtech?. Get real-time updates, technical details, and mitigati

What is the Real Relationship between WordPress Hackers and Malicious Adtech? - Live Threat Intelligence - Threat Radar | OffSeq.com

What is the Real Relationship between WordPress Hackers and Malicious Adtech?

Hazy Hawk, a sophisticated threat actor, exploits abandoned cloud resources of high-profile organizations through DNS hijacking. By identifying and taking over dangling CNAME records pointing to unused cloud services, they create malicious URLs on reputable domains. These URLs lead users to scams and malware via traffic distribution systems. Hazy Hawk employs layered defenses, including domain obfuscation and content theft from legitimate websites, to avoid detection. They also leverage push notifications to maintain persistent access to victims. The attacks have impacted government agencies, universities, and major corporations worldwide since at least December 2023. This campaign highlights the importance of proper DNS management and the growing sophistication of cybercriminals in the affiliate marketing space.

The threat campaign titled "Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor" involves a sophisticated adversary known as Hazy Hawk exploiting abandoned or forgotten cloud resources through DNS hijacking techniques. Specifically, the attacker identifies dangling CNAME records—DNS entries that point to cloud services or domains no longer in use or controlled by the legitimate organization. By taking control of these dangling CNAMEs, Hazy Hawk effectively creates malicious URLs under reputable domains, leveraging the trust and reputation of these domains to deceive users. These URLs are then used as entry points to scams and malware distribution, facilitated by traffic distribution systems (TDS) that route victims to various malicious payloads or fraudulent content. The attacker employs advanced evasion techniques, including domain obfuscation to mask the true nature of the malicious domains, and content theft from legitimate websites to make the malicious pages appear authentic and avoid detection by security tools. Additionally, Hazy Hawk uses push notifications to maintain persistent access and engagement with victims, increasing the likelihood of successful scams or malware infections. The campaign has been active since at least December 2023 and has targeted a broad range of high-profile organizations globally, including government agencies, universities, and major corporations. The presence of domains such as "jameshardie.eu", "jameshardie.it", and "pass-jeux.gouv.fr" among the indicators suggests a focus on European targets, including governmental and commercial entities. This campaign underscores the critical importance of diligent DNS management, particularly the monitoring and cleanup of unused DNS records, to prevent exploitation by threat actors. It also highlights the increasing sophistication of cybercriminals in leveraging cloud infrastructure and affiliate marketing tactics to amplify their reach and impact.

Detailed information about Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor. Get real-time updates, technical details, and mitigation s

Title	Severity	Type	Source	Date

Threats Tagged 'push notifications'

Filter Threats

Threats Tagged 'push notifications'