Advertisement Banner
  • Home
  • News
  • Cyber News
  • Contact
No Result
View All Result
  • Home
  • News
  • Cyber News
  • Contact
No Result
View All Result
Wellnessnewshubb
No Result
View All Result
Home Cyber News

250+ U.S. news sites spotted spreading FakeUpdates malware in a supply-chain attackSecurity Affairs

admin by admin
November 3, 2022
in Cyber News


Threat actors compromised a media company to deliver FakeUpdates malware through the websites of hundreds of newspapers in the US.

Researchers at Proofpoint Threat Research observed threat actor TA569 intermittently injecting malicious code on a media company that serves many major news outlets. The media company serves The media company provides video content and advertising via Javascript to its partners. The attackers modified the JS to deploy the FakeUpdates malware, aka SocGholish, through the websites of hundreds of newspapers in the US.

Impacted media organizations serve:
Boston
New York
Chicago
Miami
Washington, DC
Cincinnati
Palm Beach
and include other national news outlets

— Threat Insight (@threatinsight) November 2, 2022

Visitors of compromised websites were infected with malware payloads masqueraded as fake browser updates (i.e. Chromе.Uрdatе.zip, Chrome.Updater.zip, Firefoх.Uрdatе.zip, Operа.Updаte.zip, Oper.Updte.zip). The users are tricked into downloading ZIP archives containing the malware via fake update alerts.

“We track this actor as #TA569. TA569 historically removed and reinstated these malicious JS injects on a rotating basis. Therefore the presence of the payload and malicious content can vary from hour to hour and shouldn’t be considered a false positive.” reads a tweet published by the company.

The security firm revealed that more than 250 U.S. news outlets were impacted by this supply chain attack, including the websites of major news organizations.

Impacted media organizations serve major news outlets from New York, Boston, Chicago, Miami, Washington, D.C., and more.

In July, Microsoft researchers discovered a malware campaign that the FakeUpdates malware was being distributed via Raspberry Robin malware. Recently Microsoft discovered a malicious activity that links the Raspberry Robin worm to human-operated ransomware attacks. 

Microsoft experts observed the threat actor DEV-0206 using the worm to deploy a downloader on networks that were also compromised by threat actors using Evil Corp TTPs.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, malware)



Share On






Source link

Previous Post

Imran Khan safe after “assassination attempt”

Next Post

China Celebrates German Chancellor’s Trip – The Diplomat

Next Post

China Celebrates German Chancellor’s Trip – The Diplomat

Recommended

Airline company Air France-KLM discloses security breachSecurity Affairs

2 months ago

White House argues platforms should be liable if algorithms promote harmful content

3 months ago

© 2022 Law Enforcement News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Cyber News
  • Contact

Newsletter Sign Up.

No Result
View All Result
  • Home
  • News
  • Cyber News
  • Contact

© 2022 Law Enforcement News Hubb All rights reserved.