Gumblar and More On Javascript Obfuscation
Summary: Gumblar is malware named for the site that originally hosted it, hxxp://gumblar.cn, and it spreads by stealing FTP credentials from compromised systems to infect web sites and by delivering a malicious JavaScript payload that hits clients with Acrobat and Flash exploits. Once on a user's system it redirects Google search results to malware-laden pages, and a week before the post Sophos had declared it the fastest-growing threat on the Internet.
Key Takeaway: The existing Snort rule for obfuscated JavaScript, GID 1 SID 15363, does not fire on Gumblar because its payload leaves calls like indexOf() and document.write() unescaped, and the VRT notes that tracking nested parentheses is not happening in Snort or any IDS soon - so detection of the fastest-growing threat on the Internet depended on new rules still being tested.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026