A sprawling infrastructure that has been bilking unsuspecting people through fraudulent gambling websites for 14 years is likely a dual operation run by a nation-state-sponsored group that is targeting government and private-industry organizations in the US and Europe, researchers said Wednesday.
Researchers have previously tracked smaller pieces of the enormous infrastructure. Last month, security firm Sucuri reported that the operation seeks out and compromises poorly configured websites running the WordPress CMS. Imperva in January said the attackers also scan for and exploit web apps built with the PHP programming language that have existing webshells or vulnerabilities. Once the weaknesses are exploited, the attackers install a GSocket, a backdoor that the attackers use to compromise servers and host gambling web content on them.
All of the gambling sites target Indonesian-speaking visitors. Because Indonesian law prohibits gambling, many people in that country are drawn to illicit services. Most of the 236,433 attacker-owned domains hosting the gambling sites are hosted on Cloudflare. Most of the 1,481 hijacked subdomains were hosted on Amazon Web Services, Azure, and GitHub.
This post sheds light on a concerning issue that affects many people. It’s important to raise awareness about such fraudulent activities and their broader implications. Thanks for sharing this information!
Absolutely, raising awareness is crucial. It’s interesting to consider how such networks might also be linked to organized crime, potentially affecting not just individuals, but entire communities. Understanding the broader implications can help us advocate for better protections.
influence other areas, like money laundering or organized crime. The interconnectedness of these activities can make it even harder to combat. It’s definitely a complex issue that requires a multi-faceted approach!