Tag: seo

6 Attack Reports | 0 Vulnerabilities

Attack reports

CNCERT: Risk Warning Regarding the "Black Cat" Gang's Use of Search Engines to Spread Counterfeit Notepad++ Download Remote Control Backdoors

CNCERT and Microstep Online jointly detected a cyberattack campaign launched by the "Black Cat" criminal gang. This gang uses search engine SEO (Search Engine Optimization) techniques to push meticulously crafted phishing websites to the top of search engine keyword results. After visiting these hi…

Published: January 9, 2026

Downloadable IOCs: 17

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

The TamperedChef campaign is a global malvertising and SEO operation that distributes seemingly legitimate software with valid code signing to trick users into executing malicious installers. These fake applications mimic common software and establish persistence through scheduled tasks, delivering…

social engineering

scheduled tasks

javascript payload

shell companies

code-signing certificates

signed applications

Published: November 26, 2025

Downloadable IOCs: 132

The Rise of Online Casino Spam

This analysis explores the growing prevalence of online casino spam, particularly targeting WordPress websites. The report details a sophisticated malware infection that employs multiple layers of redundancy and reinfection mechanisms. The malware injects spam content into existing pages, stores pa…

Published: November 7, 2025

Downloadable IOCs: 0

IIS servers owned by RudePanda like it's 2003

A new malicious IIS module called 'HijackServer' has been detected compromising IIS servers by exploiting exposed ASP .NET machine keys. The attackers use a customized rootkit and ready-made tools to gain persistent access. While primarily aimed at search engine optimization for cryptocurrency scam…

remote command execution

hijackdrivermanager

Published: October 22, 2025

Downloadable IOCs: 36

Analysis of a Malicious WordPress Plugin: The Covert Redirector

A malicious WordPress plugin named 'wordpress-player.php' has been discovered, affecting at least 26 websites. The plugin injects a hidden HTML5 video player and establishes a WebSocket connection to a command and control server. It redirects visitors to suspicious websites after 4-5 seconds, avoid…

wordpress-player.php

website-integrity

Published: June 19, 2025

Downloadable IOCs: 1

Fake WordPress Plugin Impacts SEO by Injecting Casino Spam

A recent investigation uncovered a malicious WordPress plugin disguised as an innocent security tool, injecting casino spam into website footers. The attackers employed obfuscation techniques and cURL to fetch data from a remote URL, decrypting it using XOR encryption. The malware retrieves a set o…

Published: February 27, 2025

Downloadable IOCs: 1

Click here to see more Attack Reports