Proofpoint Threat Research has observed intermittent injections on a media company that serves many major news outlets. This media company serves content via #Javascript to its partners. By modifying the codebase of this otherwise benign JS, it is now used to deploy #SocGholish.
We track this actor as #TA569. TA569 historically removed and reinstated these malicious JS injects on a rotating basis. Therefore the presence of the payload and malicious content can vary from hour to hour and shouldn't be considered a false positive.
Proofpoint observed TA569 injects within the assets of a media company used by multiple major news orgs. More than 250 regional/national newspaper sites have accessed the malicious Javascript. The actual number of impacted hosts is known only by the impacted media company.
Impacted media organizations serve:
Boston
New York
Chicago
Miami
Washington, DC
Cincinnati
Palm Beach
and include other national news outlets
The @ET_Labs team has released out-of-band network detection logic for our supported engines: SID 2039620 is available as part of our ET Open ruleset, free to our customers and the community.
Thanks to researchers @ex_raritas @DustyMMiller @0xkyle.
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.