Over 150K websites hit by full-page hijack linking to Chinese gambling sites
March 27, 2025, 10:22 p.m.
Description
In February, C/Side uncovered a threat actor targeting over 35,000 websites with a malicious full-page hijack injection. C/Side continued to monitor this actor’s activities and have identified new tactics and techniques. They’ve scaled up their operations significantly, as we now estimate that approximately 150,000 websites have been impacted by this campaign.
Tags
Date
- Created: March 27, 2025, 9:50 p.m.
- Published: March 27, 2025, 9:50 p.m.
- Modified: March 27, 2025, 10:22 p.m.
Indicators
- www.wa38di.com
- https://www.wa38di.com:7443/other/restrictionIp?name=access-caveat
- https://t399229.com/
- https://g977115.com/
- https://lucky298.com/
- https://b217102.cc/
- https://888fff.zuizhongyj.com/jump.js
- https://888fff.zuizhongyj.com/'
- https://551007t.cc/
- 888fff.zuizhongyj.com
- t399229.com
- lucky298.com
- g977115.com
- b217102.cc
- 551007t.cc
Attack Patterns
- JavaScript
- T1574
- T1547
- T1055
- T1027