Waterholing campaign compromises four South Korean websites

guest · Mar 29, 2019

Waterholing campaign compromises four South Korean websites
March 29, 2019
https://www.scmagazineuk.com/waterh...es-four-south-korean-websites/article/1580524

Trend Micro described the campaign, which it named Soula, as a significant threat to enterprises and users and possibly the first step being taken by a cyber-criminal group to launch a bigger, worldwide campaign.

What the research firm found was four websites that were injected with JavaScript, exactly how was not mentioned but possibly through unpatched vulnerabilities, which then would overlay a login form over the legitimate site.
Making matters worse is one of the spoofed sites is one of South Korea’s most popular search engines.

The attackers are also actively improving the malware having added obfuscation to the JavaScript and moved the scripts to a new server after Trend Micro notified Cloudflare of the situation. However, the attack can still be defeated by having companies maintain their patch schedule and add features like 2FA whenever possible.

"As a form of protection to all credential stealing campaigns, users should enable two-factor authentication wherever possible, and adopt a multi-layered defence system that can help to filter out malicious URLs and pop-ups."
Click to expand...

Trend Micro: Desktop, Mobile Phishing Campaign Targets South Korean Websites, Steals Credentials Via Watering Hole

Log in or Sign up

Waterholing campaign compromises four South Korean websites

guest Guest

Log in or Sign up

Waterholing campaign compromises four South Korean websites

guest Guest

Useful Searches