2015-02-11 - WINDIGO GROUP NUCLEAR EK

NOTICE:

ASSOCIATED FILES:

 

NOTES:

For more information about Operation Windigo, ESET published a report available here.

 

A key indicator for Operation Windigo is traffic that triggers the EmergingThreats alert ET CURRENT_EVENTS Cushion Redirection (sid:2017552)

 

Here are IP addresses and domains I've noticed for Cushion redirection so far this year (ones not previously posted on this blog):

 

In today's Nuclear EK traffic, the Flash exploit was the same all three times:

 

But the landing pages and malware payloads were different each time:

 

The malware payload appears to be the same basic file, just changed enough for a different file hash.

 

filestore72[.]info has been compromised by the Windigo Group and is generating the Cushion redirect.  This domain is normally used to push fake Java updates and similar files:

 

TODAY'S TRAFFIC

ASSOCIATED DOMAINS:

 

COMPROMISED WEBSITE AND CUSHION REDIRECT CHAIN - EXAMPLE 1:

NUCLEAR EK - EXAMPLE 1:

 

COMPROMISED WEBSITE AND CUSHION REDIRECT CHAIN - EXAMPLE 2:

NUCLEAR EK - EXAMPLE 2:

 

COMPROMISED WEBSITE AND CUSHION REDIRECT CHAIN - EXAMPLE 3:

NUCLEAR EK - EXAMPLE 3:

 

Click here to return to the main page.