Thread by @threatinsight

Proofpoint Threat Research has observed intermittent injections on a media company that serves many major news outlets. This media company serves content via #Javascript to its partners. By modifying the codebase of this otherwise benign JS, it is now used to deploy #SocGholish.

We track this actor as #TA569. TA569 historically removed and reinstated these malicious JS injects on a rotating basis. Therefore the presence of the payload and malicious content can vary from hour to hour and shouldn't be considered a false positive.

Proofpoint observed TA569 injects within the assets of a media company used by multiple major news orgs. More than 250 regional/national newspaper sites have accessed the malicious Javascript. The actual number of impacted hosts is known only by the impacted media company.

Impacted media organizations serve:
Boston
New York
Chicago
Miami
Washington, DC
Cincinnati
Palm Beach
and include other national news outlets

The @ET_Labs team has released out-of-band network detection logic for our supported engines: SID 2039620 is available as part of our ET Open ruleset, free to our customers and the community.

Thanks to researchers @ex_raritas @DustyMMiller @0xkyle.