When Vulnerable Sites Go Bad: Hijacked Websites Found Serving Ransomware

On July 19th, a wave of business websites was hijacked to deliver ransomware to anyone who visits their site. According to reports, Dunlop Adhesives, the official tourism site for Guatemala, and other legitimate websites were among those that were impacted.

The sites were said to have been exploited by a botnet called SoakSoak, or a similar automated attack that searches for vulnerable or unpatched content management systems (CMS). The affected sites were observed redirecting visitors to a malicious website that attempts to install CryptXXX, a ransomware family first discovered in April 2016 that features anti-VM and anti-analysis functions that allow it to evade detection.

The SoakSoak botnet identifies a vulnerable website by adding redirection scripts that sends visitors to an alternate site that hosts the Neutrino exploit kit, a “commercial” malware-dropping tool sold in the underground black market.

In this recent incident, the Neutrino exploit kit checks if the endpoint is using any security software, or a Flash Player debugging utility. According to the blog post, if those programs are not found on the victim, the command shell is opened and the Windows utility of the Windows Script Host is accessed to download the ransomware payload from a command and control (C&C) server.

When Good Sites Go Bad

The routine isn't new. Attackers have been compromising websites using malvertising campaigns, and many other techniques to direct users to exploit kits. Compromised sites victimize users by redirecting them towards another site that contains the exploit kit code. In most cases, these sites were easily compromised because of the unpatched or vulnerable CMS software used for these servers. In November 2015, Trend Micro reported the first ElTest campaign that delivered ransomware to visitors of compromised websites using the Angler exploit kit. Based on findings, the campaign managed to take over more than 1,500 websites, and similarly used them to distribute Cryptesla ransomware (detected as RANSOM_CRYPTESLA.YYSIX). The ElTest campaign usually added a SWF object to pages on the compromised website, which loads another Flash file to inject a hidden iFrame that led users to exploit kits.

ElTest was not the only campaign that targeted vulnerable websites. Other campaigns targeted sites that run popular content management systems like WordPress, Joomla, and Drupal. The affected sites were running unpatched and vulnerable versions of these systems, or widely-used third party add-ons.

[READ: Joomla and WordPress Sites under Constant Attack from Botnets]

Vulnerable Content Management Systems: Easy Targets

Content management systems have remarkably evolved over the past years. Current CMS platforms offer a feature-rich and intuitive interface that individual users and businesses can use to publish their digital content. Businesses are adopting CMS platforms to take advantage of the convenience these publishing systems provide, especially when addressing the need to make quick changes to their web content, support multiple users working collaboratively, and customize content for their visitors.

Unfortunately, the vast amount of third-party components such as plugins, themes, and custom add-ons can make their CMS platforms highly susceptible to security flaws and cyber-attacks. The combination of these factors allows attackers to target websites and compromise them with relatively low effort, while potentially affecting a large number of the site's users. Cybercriminals also leverage the affected website's popularity to get quick returns by targeting and exploiting unpatched or vulnerable components of their CMS-run websites, as seen in this recent incident.

Reducing the Risks