Lizamoon attacks and generic detection
Summary: Cisco Talos describes the "Lizamoon" attacks as a rapidly spreading SQL injection named for the domain hosting the script dropped onto pages across the web, obfuscated through use of the char() function. Talos says Sourcefire/Snort users are already covered by SID 13989, which will be enabled in some default policies going forward, while SID 18604 will be released in the next SEU to detect the code dropped onto infected sites.
Bottom line: The generic rule that catches Lizamoon was written for earlier SQL injection attacks like Asprox, so the same detection covers a new family without a new signature - a reminder that the rules already enabled on your sensors may be the only thing standing between a fast-spreading injection campaign and your web properties.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026