Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated SEO spam infection was discovered utilizing a cleverly crafted plugin that mimics the infected domain's name to avoid detection. The malware injects spam content into websites, targeting search engine rankings, and only activates under specific conditions like when a crawler is detected. The plugin's code is heavily obfuscated, using thousands of variable assignments broken into small parts. When decoded, the malware downloads files from external hosts, fetches remote content, and delivers custom spam to search engines while appearing normal to regular users. The attacker's domain, mag1cw0rld[.]com, is used for remote control. This technique allows the spam to remain undetected for longer periods, making it challenging to identify with traditional tools.

This threat involves a sophisticated SEO spam campaign that leverages a malicious WordPress plugin designed to evade detection by mimicking the infected website's own domain name. The malware is embedded within a plugin that appears legitimate and uses heavy code obfuscation techniques, including thousands of fragmented variable assignments, to conceal its true functionality. Once active, the plugin injects spam content into the infected website, but only under specific conditions such as when a search engine crawler visits the site. This selective activation helps the malware avoid detection by regular users and traditional security tools. The malicious code downloads additional files from external hosts and fetches remote content controlled by the attacker via the domain mag1cw0rld.com, which serves as a command and control (C2) server. The injected spam content is tailored to manipulate search engine rankings, thereby potentially damaging the SEO reputation of the victim's website and redirecting traffic or boosting attacker-controlled sites. The use of domain mimicry and obfuscation techniques complicates detection and remediation efforts. Although no known exploits are reported in the wild, the stealthy nature of this malware and its ability to evade conventional detection mechanisms make it a persistent threat to WordPress-based websites.

Detailed information about Fake Spam Plugin Uses Victim's Domain Name to Evade Detection. Get real-time updates, technical details, and mitigation strategies.

Fake Spam Plugin Uses Victim's Domain Name to Evade Detection - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake Spam Plugin Uses Victim's Domain Name to Evade Detection

A series of attacks targeting poorly managed MS-SQL servers have been identified, involving the installation of Ammyy Admin, a remote control tool. The attackers exploit vulnerable servers, execute commands to gather system information, and use WGet to install additional malware. The installed malware includes Ammyy Admin (mscorsvw.exe), its settings file (settings3.bin), and PetitPotato (p.ax). The attackers utilize an old version of Ammyy Admin (v3.10) and employ known exploitation methods to gain remote control. They also use PetitPotato for privilege escalation, adding new users and activating RDP services. To prevent such attacks, administrators are advised to use strong passwords, update software regularly, and implement security measures like firewalls.

This threat involves a series of attacks targeting poorly managed Microsoft SQL (MS-SQL) servers. Attackers exploit weak security configurations, primarily through brute force and dictionary attacks against MS-SQL authentication, to gain initial access. Once access is obtained, they execute commands to gather system information (technique T1082) and use WGet to download and install additional malware components. The primary malware installed is an outdated version (v3.10) of Ammyy Admin, a legitimate remote control tool, disguised as 'mscorsvw.exe' alongside its configuration file 'settings3.bin'. Additionally, the attackers deploy PetitPotato (p.ax), a known privilege escalation tool that exploits Windows token impersonation vulnerabilities to elevate privileges (technique T1068). With escalated privileges, the attackers create new user accounts and enable Remote Desktop Protocol (RDP) services to maintain persistent remote access. The attack chain leverages multiple MITRE ATT&CK techniques including brute force (T1110), remote service exploitation (T1021), command execution (T1059), and persistence via new user creation (T1136). The use of an outdated Ammyy Admin version suggests reliance on known vulnerabilities or lack of detection signatures. The attackers exploit common misconfigurations such as weak passwords and unpatched MS-SQL servers, emphasizing the importance of proper server hardening. No specific affected product versions are listed, indicating the attack targets any MS-SQL server with weak security. There are no known exploits in the wild beyond these observed attacks, and no CVSS score is assigned. The threat is rated medium severity by the source, reflecting moderate impact potential and exploitation complexity.

Detailed information about Case of Attacks Targeting MS-SQL Servers to Install Ammyy Admin. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'remote control'

Filter Threats

Threats Tagged 'remote control'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility