Pakistani Gov. Site under the Eye of Attackers

guest · Mar 14, 2019

Pakistani Gov. Site under the Eye of Attackers
March 14, 2019
https://www.infosecurity-magazine.com/news/pakistani-gov-site-under-the-eye-1/

Malicious actors who breached a Pakistani government site and delivered the ScanBox Framework payload have been tracking users who visit the site to check the status of their passport applications, according to research from Trustwave.

Since attackers compromised the site, visitors to the subdomain (tracking.dgip.gov[.]pk) of the Pakistani government website's Directorate General of Immigration & Passport load the ScanBox Framework, a JavaScript reconnaissance tool linked to many advanced persistent threat (APT) groups [...] SpiderLabs researchers wrote in today's blog post.

“In this version that we observed, Scanbox also tried to detect whether the visitor has any of a list of 77 endpoint products installed, most of these are security products, with a few decompression and virtualization tools,” researchers wrote.
Click to expand...

ScanBox Framework
ScanBox is a framework in the form of a JavaScript file. The function of ScanBox is to collect information about the visitor’s system without infecting the system. And this information includes things like the last page the user was on before visiting the compromised website,

ScanBox is particularly dangerous, as it doesn’t require malware to be successfully deployed to disk in order to steal information. Instead the key logging functionality would do the same work by simply requiring the JavaScript code to be executed by the web browser
Click to expand...

Log in or Sign up

Pakistani Gov. Site under the Eye of Attackers

guest Guest

Log in or Sign up

Pakistani Gov. Site under the Eye of Attackers

guest Guest

Useful Searches