Asprox botnet malware morphs

Share this article:
The Asprox botnet, initially exclusively used for phishing scams, is now an SQL injection vector for website attacks.

According to SecureWorks, provider of managed security services, the attack tool has infected more than 2,000 websites as of Thursday afternoon. It is used to grab victims while they're surfing the web, building up the Asprox bot family. The same people behind Asprox are responsible for Danmec, a password-stealing trojan.

Joe Stewart, director of malware research at SecureWorks, has been monitoring Asprox for more than a month. He said it had been the only bot focused on phishing, but that focus changed when he noticed a binary on a system performing SQL injection attacks.

“It appears to be trying to build up the size of the botnet, infecting people through web pages by adding an IFRAME,” Stewart told SCMagazineUS.com on Thursday.

The attacks occur on websites that are running Microsoft SQL-SVR (Server) that already have some sort of vulnerability, he added. Also, the botnet takes advantage of unpatched Microsoft Internet Explorer browsers. The attack targets range from small businesses to universities.

“It is basically working through random Google searches,” Stewart said. “It feeds random phrases and goes out and searches for those phrases.”

The botnet attempts to compromise any page that comes back with an .asp suffix and uses a defined parameter, such as ID.

While Asprox has been a minor player in the botnet field, Stewart said it is obvious it is trying to build itself up in a big way.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.