Viruses/Worms News

'Beladen' web attack has infected 40,000 websites

Tuesday, June 2, 2009

A web security firm has identified roughly 40,000 legitimate websites that cybercriminals have hacked to redirect visitors to an exploit site called Beladen. Similar to the Gumblar attacks, the hacked websites point to a domain where visitors are infected with malware.

Beladen and Gumblar now appear to mark a new trend - mass compromises of websites that convert them into a type of botnet of infected sites, rather than botnets of hacked PCs, security experts said.

The Beladen domain attempts to infect PCs through older, vulnerable browser versions and third-party applications like QuickTime and Winzip.

Security vendor Websense warned on its blog last week that Beladen had compromised about 20,000 websites, a number which has since doubled in size.

The hacked sites have been injected with malicious, obfuscated code that leads to a site which uses a similar domain name to the legitimate Google Analytics domain, which records the user's browsing statistics for the attacker, researchers said.

That site then redirects users to Beladen, where the malware is uploaded.

"Following the recent Gumblar attack, we know that mass injections are nothing new, but these are becoming more popular and more common," a Websense researcher wrote in a blog Monday.