Abuse of hidden “well-known” directory in HTTPS sites

guest · Mar 29, 2019

Abuse of hidden “well-known” directory in HTTPS sites
March 26, 2019
https://www.zscaler.com/blogs/research/abuse-hidden-well-known-directory-https-sites

We have been monitoring the compromised HTTPS sites for a few weeks and have noticed that attackers are favoring a well-known hidden directory present on the HTTPS website for storing and distributing Shade ransomware and phishing pages.

During the past month, our cloud blocked transactions for compromised WordPress and Joomla due to Shade ransomware payloads (13.6 percent) and phishing pages (27.6 percent), with the remaining blocks due to coinminers, adware, and malicious redirectors.

The hidden /.well-known/ directory in a website is a URI prefix for well-known locations defined by IETF and commonly used to demonstrate ownership of a domain.
The attackers use these locations to hide malware and phishing pages from the administrators. The tactic is effective because this directory is already present on most HTTPS sites and is hidden, which increases the life of the malicious/phishing content on the compromised site.
Click to expand...

Log in or Sign up

Abuse of hidden “well-known” directory in HTTPS sites

guest Guest

Log in or Sign up

Abuse of hidden “well-known” directory in HTTPS sites

guest Guest

Useful Searches