Campaign Evolution: Darkleech to Pseudo-Darkleech and Beyond
Summary: Unit 42 traces the Darkleech campaign, an Apache module sold on the black market that infected thousands of Apache servers starting in 2012 and redirected visitors to exploit kits, through its 2015 rebranding as pseudo-Darkleech after the injected script appeared on IIS sites. Since September 2015 the injected script has become highly obfuscated, and from early February 2016 it added a large block of numeric characters whose separators changed from spaces to commas on 2016-02-24, semicolons on 2016-02-29, asterisks on 2016-03-07, and again on 2016-03-14.
Bottom line: Security community members have found websites compromised through this campaign on a daily basis, and in recent weeks it has led to Angler EK delivering ransomware, especially TeslaCrypt - with compromised domains and IP addresses continually changing.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026