Security experts at AlienVault Labs have uncovered a watering hole attack with a singular characteristic, the attackers are using a framework developed for reconnaissance as the primary infection vector.
Scanbox has numerous plugins that could be used to Enumerates software installed in the system (e.g. Flash versions, Flash versions, etc.)
Scanbox also include keylogging capability, when visitors browse the compromised website, all keystrokes are being recorded and sent to the C&C server periodically, the IP address that is hosting the command and control server is 22.214.171.124 and is assigned to a data center located in Hong Kong.
The agent also collects data the user submits via the web forms, the feature allows the attackers to steal sensitive data including password
According to the post published by AlienVault Labs, the threat actors compromised an unnamed industrial software firm’s website, the targeted company design software used for simulation and system engineering for a wide numerous companies in several industries, including automotive and aerospace.
This isn’t the first time that the researchers uncovered watering hole attacks to serve reconnaissance tools, and experts speculate that the targeted industries could suffer further attacks soon.
“This is a very powerful framework that gives attackers a lot of insight into the potential targets that will help them launching future attacks against them,” “We have also seen several Metasploit-produced exploits that target different versions of Java in the same IP address that hosts the Scanbox framework.” said Jaime Blasco.
The experts at AlienVault suggest administrators to monitor traffic from mail.webmailgoogle.com and js.webmailgoogle.com, because those are indicators of this attack.
(Security Affairs – Scanbox, watering hole attack)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.