Afghan Government Compromise: Browser Beware
Summary: Volexity reported in June 2015 that malicious code had resurfaced on cdn.afghanistan.af, a content delivery network serving Afghan government offices, ministries, and authorities, turning a large portion of those sites into attack surfaces against visitors. This time attackers modified jquery-1.4.2.min.js rather than gop-script.js, appending code obfuscated with the Dean Edwards Packer and base62 encoding that loads JavaScript from the Linode IP address 176.58.101.24.
Bottom line: Volexity observed only HTTP 403 responses from that address, suggesting the attackers use IP whitelisting to serve the payload to a specific set of targets, likely government and defense entities, so the only way to know who was hit is to see a 200 in your own logs.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026