Goldwave

Security Researcher

[Goldwave @OGoldwave]

#balada #inject #wordpress

Domains related to balada injection:

bind.bestresulttostart[.]com
js.cdntoswitchspirit[.]com
jquery.restartyourchoices[.]com
done.restartyourchoices[.]com

[Goldwave @OGoldwave]

#TA569

cancelledfirestarter[.]org
greedyfines[.]org
luxurycompare[.]com

[Goldwave @OGoldwave]

#TA569
New domain, doesn't seem to be active yet.

neworderspath[.]org

[Goldwave @OGoldwave]

@luc4m @Bank_Security @0xToxin @lazyactivist192 @JAMESWT_MHT @500mk500 @reecdeep This is what the panel looks like. And an example of the phishing site.

[Goldwave @OGoldwave]

#TA569

More domains:

friscomusicgroup[.]com
greenpapers[.]org
quaryget[.]org
getquery[.]org

[Mikhail Kasimov @500mk500]

#TA569

assistpayout[.]org
backendjs[.]org
devcodejs[.]org
devqeury[.]org
jqscr[.]com
jqueryh[.]org
jqueryns[.]com
jsqur[.]com
jsviewdev[.]org
l9j2sm5mxz.jqscr[.]com

Ref: https://t.co/7LlLZkIVko

[Goldwave @OGoldwave]

@GamingZinja https://t.co/OWPpVZRylq

[Goldwave @OGoldwave]

#ViperSoftX is back, doesn't look like much has changed.

c2 arrowlchat[.]com

Still fetching powershell txt records from privatproxy-schnellvpn[.]xyz

[Goldwave @OGoldwave]

@GamingZinja Yes, this is a crypto/password stealer.