Balada Injector:

The Balada Injector is known for attacking in “waves” - every month or so, the injector would use a new domain name, and a new code

iZOOlogic

The Balada Injector compromised millions of sites over the years

During a routine web monitoring operation, we discovered an address that led us down a rabbit hole of WordPress-orientated “hack waves” caused by the Balada Injector malware. This evidence suggests that the malware is still at large and still evading security software by utilizing new domain names and slight changes between the waves of obfuscated attacks.

Balada Injector still at large – new domains discovered
Updated on: 10 August 2023

Cybernews Team
Cybernews Team
Image by Cybernews.

__________________________________________________________________________________

. . .One of the signs that a WordPress based website is infected with Balada Injector or other browser injection vulnerability employing malware is unexpected redirects to suspicious websites. Thus, if you have ever seen that on your website you’re in a dire need of a security checkup.

Absolute mitigation of this risk from the user's perspective is simply opting not to use JavaScript (turning that off in the browser or using a NoScript extension) as that would block the malicious payload executed by an infected website.

__________________________________________________________________________________

__________________________________________________________________________________

Tracing leaked Pentagon documents

Aric Toler of Bellingcat traced the leak of US Justice Department and Pentagon documents online, some of which the government designated Top Secret, with some involving the invasion of Ukraine. Toler found evidence these documents were first posted as early as January on a Discord server, but may have appeared online before that. Toler spoke with some on the Discord server that the documents were originally posted on a now deleted server earlier, but could not confirm. From there the documents spread to 4Chan. In March they made their way to Telegram channels and Twitter, where the New York Times and other media outlets picked them up.

12 August 2023

Balada Injector:

The Balada Injector compromised millions of sites over the years

Balada Injector still at large – new domains discovered

Tracing leaked Pentagon documents

Balada Injector: A Massive Ongoing WordPress Malware Campaign | Secure Blink

Trouble in Paradise: Battling the Balada Injector - DEV Community

Denis on Twitter: "Analysis of the recent massive Balada Injector wave (cdn.scriptsplatform[.]com) that started right after the Essential Addons for Elementor plugin vulnerability disclosure. https://t.co/TiAs8rdQZ4 Had the privilege to contribute to this

The Cyber Security Hub™ على LinkedIn: Massive Balada Injector campaign attacking WordPress sites since 2017

Ethical Hackers Academy on LinkedIn: Balada Injector - Massive Ongoing WordPress Malware Infected Over 1…

Balada Injector ha infettato più di un milione di siti Web WordPress

WordPress Malware Infected Over 1 Million Websites

Unveiling the Balada injector: a malware epidemic in WordPress | Cybernews

Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign

No comments:

New Map Shows Community Broadband Networks Are Exploding In U.S. | Techdirt