Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving
Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.
Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.
- 751,331 landing URL incidents; 253,644 unique in Q2 2022.
- Unique host URL incidents rose 42% quarter over quarter.
- JavaScript downloader case study shows evolving evasion techniques.
- Most malicious domains geolocated to the US, Germany, and Russia.
- Vendors
- Palo Alto Networks
- Products
- Advanced URL Filtering
- Organizations
- Unit 42
- Countries
- United StatesGermanyRussia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | js.digestcolect.com | licious domains, including train[.]developfirstline[.]com , js[.]digestcolect[.]com and stat[.]trackstatisticsss[.]com . Figure 11. Deobfus |
| domain | stat.trackstatisticsss.com | rain[.]developfirstline[.]com , js[.]digestcolect[.]com and stat[.]trackstatisticsss[.]com . Figure 11. Deobfuscated source code of a malicious in |
| domain | train.developfirstline.com | clicked. We identified several malicious domains, including train[.]developfirstline[.]com , js[.]digestcolect[.]com and stat[.]trackstatisticsss[ |
| sha256 | bb38741575706a94cc1a3ab43d445b641b2c225f408d67a76d3302ca1233e122 | 0200 Indicators of Compromise Malicious Web Skimmer SHA256: bb38741575706a94cc1a3ab43d445b641b2c225f408d67a76d3302ca1233e122 Train[.]developfirstline[.]com Js[.]digestcolect[.]com stat |
From the original article
8 min read at unit42.paloaltonetworks.com
Palo Alto Networks Advanced URL Filtering subscription collects data regarding two types of URLs; landing URLs and host URLs. We define a malicious landing URL as one that allows a user to click a malicious link. A malicious host URL is a page containing a malicious code snippet that could abuse someone’s computing power, steal sensitive information or perform other types of attacks.
By Tao Yan, Jin Chen, Taojie Wang, Cecilia Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.