'Darkleech' malware undertakes ransomware campaign

Websites hosted on Apache servers are modified to serve up malware

A persistent, widespread malware campaign that uses compromised Apache servers is locking users' computers and demanding a fee of $300 to free their data.

A persistent, widespread malware campaign that uses compromised Apache servers is locking users' computers and demanding a fee of $300 to free their data.

A persistent, widespread malware campaign that utilizes compromised Apache servers is locking users' computers and demanding a fee of US$300 to free their data.

Researchers from Eset wrote that the ransomware scam is an extension of a long-running attack that compromises the infrastructure of web hosting companies with a variant of a malicious Apache module called "Darkleech."

"Malicious modification of server binaries seems to be a very popular trend for malware distribution," wrote Sebastien Duquette, an Eset malware researcher, on a company blog.

Eset also suspects that hackers also may have figured out how to compromise CPanel and Plesk, which are both software programs used by hosting companies to manage their networks and websites.

Darkleech tampers with websites hosted on an Apache server. It loads an iframe into a web page and redirects a victim to a malicious URL that hosts the Blackhole exploit kit, Duquette wrote. Eset detected at least 270 websites that redirected victims this way in the last week.

The Blackhole kit then tries to exploit unpatched web browsers or vulnerable Java or Adobe Reader plugins in order to install malware. If an exploit is successful, several pieces of malware are placed on the victim's computer, Duquette wrote.

One of those malware programs, called Nymaim, locks the victim's computer and asks for a fee. Duquette wrote the Nymaim ransomware campaign, which has been running for a long time, is customized according to the approximate location of the user. U.S.-based users, for example, see a bogus warning from the U.S. Federal Bureau of Investigation.

It appears attackers are still having much success using the Blackhole exploit kit. As many as 40,000 IPs have been used in campaigns, and in May alone, 15,000 IP addresses were serving up the kit at the same time, Duquette wrote.

"Given how successful these campaigns have been so far at redirecting massive amounts of visitors it is hardly surprising to see these abuses on the increase," Duquette wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags intrusionsecurityExploits / vulnerabilitiesesetdata protectionmalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?