Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service

A new traffic direction system (TDS) called Parrot has been
spotted leveraging tens of thousands of compromised websites to
launch further malicious campaigns.

“The TDS has infected various web servers hosting more than
16,500 websites, ranging from adult content sites, personal
websites, university sites, and local government sites,” Avast
researchers Pavel Novák and Jan Rubín said^[1]
in a report published last week.

Traffic direction systems are used by threat actors to determine
whether or not a target is of interest and should be redirected to
a malicious domain under their control and act as a gateway to
compromise their systems with malware.

Earlier this January, the BlackBerry Research and Intelligence
Team detailed another TDS called Prometheus^[2]
that has been put to use in different campaigns mounted by
cybercriminal groups to distribute Campo Loader, Hancitor, IcedID,
QBot, Buer Loader, and SocGholish malware.

What makes Parrot TDS stand out is its huge reach, with
increased activity observed in February and March 2022, as its
operators have primarily singled out servers hosting poorly secured
WordPress sites to gain administrator access.

Most of the users targeted by these malicious redirects are
located in Brazil, India, the U.S, Singapore, Indonesia, Argentina,
France, Mexico, Pakistan, and Russia.

“The infected sites’ appearances are altered by a campaign
called FakeUpdate (also known as SocGholish), which uses JavaScript
to display fake notices for users to update their browser, offering
an update file for download,” the researchers said. “The file
observed being delivered to victims is a remote access tool.”

Parrot TDS, via an injected PHP script hosted on the compromised
server, is designed to extract client information and forward the
request to the command-and-control (C2) server upon visiting one of
the infected sites, in addition to allowing the attacker to perform
arbitrary code execution on the server.

The response from the C2 server takes the form of JavaScript
code that’s executed on the client machine, exposing the victims to
potential new threats. Also observed alongside the malicious
backdoor PHP script is a web shell that grants the adversary
persistent remote access to the web server.

Calling the criminal actors behind the FakeUpdate campaign a
prevalent customer of Parrot TDS, Avast said the attacks involved
prompting users to download malware under the guise of rogue
browser updates, a remote access trojan named “ctfmon.exe” that
gives the attacker full access to the host.