Sophisticated Malware Campaign Targets WordPress Sites and Diplomatic Entities

A malware campaign known as Sign1 has compromised over 39,000 WordPress sites by injecting malicious JavaScript to redirect users to scam sites. At the same time, a separate cyber attack involving the WINELOADER backdoor targeted diplomatic entities with phishing emails linked to Russia’s Foreign Intelligence Service.

At a glance

• Sign1 malware campaign targeting WordPress sites.
• Malicious JavaScript injections redirect users to scam sites.
• Sign1 malware facilitates redirects to VexTrio’s traffic distribution system.
• Visitors to affected sites are redirected to scam sites.
• APT29 cyber attack targeting diplomatic entities with WINELOADER backdoor.

The details

A sophisticated malware campaign known as Sign1 has been targeting WordPress sites, compromising over 39,000 websites in the last six months.

The malware utilizes malicious JavaScript injections to redirect users to scam sites, with the most recent variant infecting an estimated 2,500 sites in the past two months.

The attacks involve injecting rogue JavaScript into legitimate HTML widgets and plugins, using XOR-encoded JavaScript code that is decoded and executed from a remote server.

Sign1 Malware Operation

The Sign1 malware facilitates redirects to a traffic distribution system operated by VexTrio, employing time-based randomization to fetch dynamic URLs that change every 10 minutes.

Domains used in the attacks are registered shortly before their use, and the malware checks if visitors have come from major websites like Google, Facebook, Yahoo, and Instagram before executing.

Impact on Visitors

Visitors to affected sites are redirected to scam sites by executing additional JavaScript from the same server.

Since the second half of 2023, the Sign1 campaign has seen multiple iterations, with WordPress sites potentially compromised through brute-force attacks or exploiting security flaws in plugins and themes.

Malicious injections are often discovered inside WordPress custom HTML widgets, and attackers install a legitimate Simple Custom CSS and JS plugin to inject malicious code, allowing the malware to remain undetected for extended periods.

In a separate cyber attack incident, the WINELOADER backdoor was utilized in phishing attacks targeting diplomatic entities, with phishing emails containing wine-tasting lures.

The hacking group behind the attacks, known as Midnight Blizzard or APT29, has links to Russia’s Foreign Intelligence Service (SVR). The attacks targeted German political parties around February 26, 2024, using phishing emails bearing the logo of the Christian Democratic Union (CDU).

APT29 Cyber Attack

This marks the first time the APT29 cluster has targeted political parties. WINELOADER was first disclosed by Zscaler ThreatLabz last month as part of an ongoing cyber espionage campaign since at least July 2023. The attack chains leverage phishing emails with German-language lure content, invoking the malware through DLL side-loading using the legitimate sqldumper.exe.

WINELOADER has been employed in operations targeting diplomatic entities in multiple countries, with German prosecutors charging a military officer with espionage offenses for allegedly spying on behalf of Russian intelligence services.

These incidents highlight cyber attackers’ evolving tactics and the increasing sophistication of malware campaigns targeting WordPress sites and diplomatic entities, underscoring the importance of robust cybersecurity measures to protect against such threats.

Article X-ray