A new traffic direction system (TDS) called Parrot has been spotted leveraging tens of thousands of compromised websites to launch further malicious campaigns.
"The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites," Avast researchers Pavel Novák and Jan Rubín said in a report published last week.
Traffic direction systems are used by threat actors to determine whether or not a target is of interest and should be redirected to a malicious domain under their control and act as a gateway to compromise their systems with malware.
Earlier this January, the BlackBerry Research and Intelligence Team detailed another TDS called Prometheus that has been put to use in different campaigns mounted by cybercriminal groups to distribute Campo Loader, Hancitor, IcedID, QBot, Buer Loader, and SocGholish malware.
What makes Parrot TDS stand out is its huge reach, with increased activity observed in February and March 2022, as its operators have primarily singled out servers hosting poorly secured WordPress sites to gain administrator access.
Most of the users targeted by these malicious redirects are located in Brazil, India, the U.S, Singapore, Indonesia, Argentina, France, Mexico, Pakistan, and Ru ..
Support the originator by clicking the read the rest link below.
