Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dormant Malicious Code Discovered on Thousands of Websites

Summary: On November 3, 2015, ZScaler reported that the Chuxiong Archives site, www.cxda[.]gov.cn, a Chinese government website, was compromised with injected code leading to the Angler Exploit Kit, and Unit 42 found the code could switch between an active and dormant state based on the request's source IP and user agent. During continuous monitoring from November 11 to November 12, 2015, the site still served malicious content depending on IP and user agent, and Unit 42 said it had found more than four thousand additional compromised websites globally with the same dormant-or-active behavior.

Key Takeaway: A site that looks clean on a second visit may simply be dormant, so a scan from one IP and user agent can clear a website that is still infected and still serving the Angler Exploit Kit to other visitors.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related