New Domain – Same Damage

If you have a website, you may have had your website attacked by cybercriminals using the Gumblar.cn hack.

This hack was responsible for thousands of websites serving infectious code to their visitors.

However, the domain that was hosting further links to malicious downloads was gumblar.cn however, that domain has been shutdown and now many of the newer infections are using martuz.cn as their primary malicious download domain.

What the new code does is check to see if you are visiting using the Google Chrome browser on Windows XP and your browser is set to allow cookies.

I think, the reason behind this is to prevent the automated scanners from finding their infectious code. Many scanners don’t try different user agents, referers or allow cookies. This prevents them from finding these new malscripts.

We’ve even seen where sites had their robots.txt file modified and only the webpages that were serving up malscripts were inserted into the robots.txt so Google wouldn’t index them.

This all points to the fact that many people rely on Google to check their site for malscripts. Google will of course post their moniker “This site may harm your computer” on all of the Search Engine Result Pages (SERPs) and browsers like Google Chrome and Firefox will alert all visitors to the infectious website of it’s malware intentions. This typically will create a desire in some to notify the site owner who then goes into recovery mode to clean their site.

You can’t just scan your sites for any line that contains martuz.cn as the script files being inserted have obfuscated the domain name so it must be concatenated in order to see it. The malscripts are inserted into .htm, .html, .asp, .aspx, .js and .php files.

The cybercriminals have been very clever at disguising their malscripts.

It still appears that the way the cybercriminals gain access to websites is through a virus on the system that uploads to the website. This virus doesn’t seem to be detectable by many of the more popular anti-virus programs. We’ve worked with thousands of site owners, many of them had Norton or McAfee and they weren’t able to detect the virus.

We’ve been recommending AVG or Avast or Malwarebytes. These seem to find the virus after many scans with other anti-virus programs failed.

We also recommend getting away from FTP. We’re putting together some video instructions on the why’s and how’s of moving away from FTP. We’ll post here when we have them ready. It should be later this week.

Until then, watch your websites for any changes. It’s the only way.