Best Cheap Web Hosting

April 19, 2016

Web hosting provider Invision Power Services (IPS) this month was saved from a systems compromise that could have potentially damaged its clients, after researchers gathered intelligence on a cybercriminal plot that was unfolding on the dark web.

The scheme was spearheaded by a bad actor dubbed AlphaLeon, who is also known to have sold the recently discovered trojan Thanatos, aka Alphabot, on the online black market. According to a new report from SurfWatch Labs, one of AlphaLeon's latest schemes was compromising IPS via an unpatched software vulnerability. Had the adversary's campaign gone undetected, IPS could have secondarily compromised its client base, which includes some professional sports leagues and media and entertainment companies.

Upon being notified, Forest, Va.-based IPS confirmed via a penetration test that a malicious hacker had, indeed, infiltrated the company's managed hosting environment, which is operated via Amazon Web Services. Such unauthorized root-level access would have allowed the hackers to install exploit kits that could have infected users visiting IPS' hosted sites with malware capable of stealing bank credentials and bitcoins, delivering ransomware, launching distributed denial of service (DDoS) attacks and more.

Fortunately, SurfWatch threat intelligence analysts appear to have caught the campaign before it was launched. Adam Meyer, chief security strategist at SurfWatch Labs, said that his team of researchers is able to detect dark web threats such as this one through a combination of automated scanning and human investigation. "We also have built a quantity of undercover personalities," Meyer told SCMagazine.com, "and we use those personalities to get into areas where we can observe the back-room conversations" where cybercriminals wheel and deal.

SurfWatch would not name IPS's clients, nor did the company identify the specific software vulnerability that was exploited. SCMagazine.com's call to IPS for further comment went unanswered.

Source: Researchers patrolling dark web uncover trojan plot targeting web hosting service