Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. The threat actors used redirector scripts to target users from various countries, mimicking the Google Play Store. Additionally, the XWorm campaign targeted Korean-speaking users through fake investment chat rooms. The Strela Stealer targeted email clients in German-speaking countries, while the WeaXor ransomware, a revised version of Mallox, was also observed. The report details the infection chains, provides IOCs, and recommends blocking CIDR ranges associated with Proton66 and Chang Way Technologies to mitigate risks.

This threat analysis focuses on a series of malware campaigns linked to the Proton66 group, which primarily target Android devices via compromised WordPress websites. The attackers leverage redirector scripts embedded in these compromised sites to funnel unsuspecting visitors to malicious payloads that mimic legitimate services such as the Google Play Store, thereby increasing the likelihood of successful infection. The campaigns are multi-faceted, including the XWorm malware targeting Korean-speaking users through fake investment chat rooms, the Strela Stealer focusing on email clients predominantly in German-speaking countries, and the WeaXor ransomware, a newer iteration of the Mallox ransomware family. 

The infection chains typically begin with exploitation of vulnerable WordPress sites, which are widely used content management systems, making them attractive targets. The redirector scripts serve as an initial infection vector, directing victims to download malware disguised as legitimate applications. The XWorm campaign employs social engineering tactics tailored to Korean-speaking victims, leveraging fake investment chat rooms to distribute malware. Strela Stealer is designed to harvest credentials from email clients, posing a significant risk to confidentiality, especially in German-speaking regions where it has been observed. The WeaXor ransomware encrypts victim data, demanding ransom payments, and represents a direct threat to availability and data integrity.

The report also highlights recommended mitigation strategies, including blocking CIDR IP ranges associated with Proton66 and Chang Way Technologies, which are linked to the infrastructure used in these campaigns. The campaigns utilize a variety of tactics, techniques, and procedures (TTPs) such as phishing (T1566), credential theft (T1552), persistence mechanisms (T1547), exploitation of public-facing applications (T1190), and execution of malicious scripts (T1059). This multi-vector approach increases the complexity and potential impact of the threat.

Detailed information about Part 2: Compromised WordPress Pages and Malware Campaigns. Get real-time updates, technical details, and mitigation strategies.

Part 2: Compromised WordPress Pages and Malware Campaigns - Live Threat Intelligence - Threat Radar | OffSeq.com

Part 2: Compromised WordPress Pages and Malware Campaigns

This intelligence briefing focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. It details how these sites were injected with malicious scripts to redirect Android users to fake Google Play Store pages. The report also covers the XWorm campaign targeting Korean-speaking users, the Strela Stealer targeting German-speaking countries, and the WeaXor ransomware. The analysis provides insights into the infection chains, malware configurations, and command-and-control servers used in these campaigns. Additionally, it offers recommendations for blocking associated IP ranges and lists numerous indicators of compromise (IOCs) for each campaign.

The Proton66 threat encompasses a series of malware campaigns primarily leveraging compromised WordPress websites to target Android users. Attackers inject malicious scripts into vulnerable WordPress pages, which then redirect Android visitors to counterfeit Google Play Store pages designed to distribute malware. This infection vector exploits the widespread use of WordPress as a content management system and the trust users place in Google Play Store interfaces. The campaigns include multiple malware families: XWorm, which targets Korean-speaking users and is known for remote access trojan (RAT) capabilities; Strela Stealer, focusing on German-speaking countries, designed to exfiltrate sensitive information such as credentials and financial data; and WeaXor ransomware, which encrypts victim data to demand ransom payments. The analysis of these campaigns reveals complex infection chains involving initial redirection, payload delivery, and command-and-control (C2) communications. Malware configurations are tailored to regional targets, indicating a strategic approach by Proton66. The campaigns also utilize specific IP ranges for C2 servers, which can be blocked to disrupt operations. While no known exploits are actively used to compromise WordPress sites, the injection of malicious scripts suggests exploitation of vulnerabilities or weak administrative controls. The campaigns demonstrate a multi-faceted approach combining phishing, malware distribution, and ransomware deployment, with a focus on Android platforms and regional targeting based on language and geography.

Detailed information about Proton66: Compromised WordPress Pages and Malware Campaigns. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'strela stealer'

Filter Threats

Threats Tagged 'strela stealer'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility