Malicious programs target Apache and hijack 20 thousand websites

Malicious programs target Apache and hijack 20 thousand websites

The malicious program tool named Darkleech is targeting the most popular Web server Apache and redirecting viewers to a third-party malicious website by embedding malicious code on the webpage. It has hijacked more than 20 thousand websites, including well-known websites such as the Los Angeles Times.

It is unclear what vulnerabilities attackers have exploited to intrude into Apache machines. Security researchers suspect that the vulnerabilities may exist in software used to manage websites, such as Plesk and Cpanel, it does not rule out the possibility of password cracking, social engineering, and other attack methods. The researchers do not know exactly how many websites Darkleech is infected because it uses complex techniques to avoid detection: If IP addresses from security companies and hosting companies access infected websites, it does not embed malicious links in Web pages displayed by end users.