Do Son 
At a Glance
- Actor or Group: Unidentified cyber criminals
- Activity Type: Malicious website redirection and malware distribution
- Targets or Victims: Internet users and legitimate website owners
- Scale: Broad global risk for financial and data loss
- Jurisdiction or Status: FBI investigating, public warning issued
- Source: Federal Bureau of Investigation (FBI)
TL;DR
The FBI issued a public warning about cyber criminals exploiting traffic distribution systems. Suspected attackers use these systems to route users to fraudulent websites. These malicious pages host phishing scams and malware payloads.
What Happened
Unidentified cyber criminals are altering legitimate website codes. They target sites using weak passwords or outdated plugins. Once breached, attackers deploy a traffic distribution system to redirect incoming visitors. According to the FBI, “Cyber criminals use TDSs to selectively redirect users to compromised or fake login websites.” These destinations host phishing pages for financial fraud or prompt harmful software downloads.
Who Is Behind It
Authorities have not publicly named specific suspects or groups. However, the FBI confirms that unknown cyber criminals run these campaigns. They allegedly sell the obtained network access to other malicious groups. Ransomware operators often buy this access for future attacks.
Impact or Scale
The exact financial damages remain unconfirmed. However, the scale of the threat is broad. A single compromised website can redirect thousands of visitors. Attackers bypass traditional firewalls by hiding the final malicious destination. The FBI notes that these systems analyze visitors, collecting IP addresses and device information. This allows attackers to filter traffic and avoid security researchers.
What Comes Next
Users should verify URLs before clicking any advertisements. Website administrators must enforce strong passwords and enable two-factor authentication. Regularly updating software plugins patches known vulnerabilities. The FBI advises businesses to “Monitor endpoints for suspicious execution of wscript.exe, cscript.exe and PowerShell scripts.” Victims should report incidents to local police and file a complaint at the Internet Crime Complaint Center.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
