Another Darkleech Campaign[html]
Last week got us up close and personal with Darkleech and Blackhole
with our external careers web site.
The fun didn’t end there, this week we saw a tidal wave of Darkleech
activity linked to a large-scale href="http://en.wikipedia.org/wiki/Malvertising">malvertising
campaign identified by the following URL:
hXXp://delivery[.]globalcdnnode[.]com/7f01baa99716452bda5bba0572c58be9/afr-zone.php
Again Darkleech was up to its tricks, injecting URLs and sending
victims to a landing page belonging to the Blackhole Exploit Kit, one
of the most popular and effective exploit kits available today.
Blackhole wreaks havoc on computers by exploiting vulnerabilities in
client applications like IE, Java and Adobe, computers that are
vulnerable to exploits launched by Blackhole are likely to become
infected with one of several flavors of malware including href="/content/fireeye-www/en_US/solutions/ransomware.html">ransomware,
Zeus/Zbot variants and href="http://en.wikipedia.org/wiki/Click_fraud">clickfraud trojans
like ZeroAccess.
We started logging hits at 21:31:00 UTC on Sunday 09/22/2013, the
campaign has been ongoing, peaking Monday and tapered down through out
the week.
During most of the campaign’s run,
delivery[.]globalcdnnode[.]com appeared to have gone dark, no
longer serving the exploit kit’s landing page as expected and then
stopped resolving altogether, yet tons of requests kept flowing.
This left some scratching their heads as to whether the noise was a
real threat.
Indeed, it was a real threat, as Blackhole showed up to the
party a couple of days later; this was confirmed by actually
witnessing a system get attacked on a subsequent visit to the URL.
