Hackers Use St. Petersburg Consulate Website to Host Malware

Hackers compromised the Website of the US Consulate General in St. Petersburg early in the 3rd week of September 2007 and loaded it with malicious code.

The compromise, however, stayed for a brief period. By the time security researchers started the manual checking of the Website, the infection had already been removed. On examining the cached version of the hacked page, they, however, succeeded in detecting the malicious code.

As of 13 September 2007, Sophos customers were blocked from accessing the Web server of St. Petersburg Consulate. The server has two hosts - www.stpetersburg-usconsulate.ru domains and stpetersburg.usconsulate.gov.

Cyber criminals dropped a code called Mal/ObfJS-C, which tries to download more malware by accessing a server in a remote location. The malware contained an extra script that tried to exploit a number of flaws in browsers with the objective of planting a Trojan on a user's computer accessing the site.

Sophos has estimated that over 400 Web pages around the world have suffered attack in the same manner during the first week of September 2007.

According to Ron O'Brien, Research Guru or Chief Analyst at Sophos, malware attackers are targeting government agencies at more frequent intervals these days.

In a research summary, O'Brien said that over the past few months, a number of government agencies and organizations of high profile have encountered attacks from cyber criminals. These attacks have been increasing at an alarming rate, which highlights the vulnerability of any organization, of any stature or size, is targeted by the hackers and their malicious activities. InfoWorld.com published it on 13 September 2007.

Fraser Howard, Principal Virus Researcher at Sophos, said that this new attack signifies no company is safe from infection. Irrespective of the size of an organization, it must fully defend its site to prevent being stung, he said. Vnunet.com published this in news on 13 September 2007.

Separately, according to a warning by McAfee's SiteAdvisor, Web surfers should not surf the Moscow embassy Website of the State Department. The alert further says that the site had been linked to e-mails that carried computer viruses.

Related article: Hackers Redirect Windows Live Search to Malicious Sites

» SPAMfighter News - 10/1/2007