Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: JSRedir-R/Gumblar badness - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
JSRedir-R/Gumblar badness

Reader Ben sent an email reminding me that I must have been living under a rock to miss the sudden uptick in Gumblar/JSRedir-R drive-bys.

Although this malware has been around for a while, several A/V vendors and some relatively mainstream news outlets have recently reported a large increase in websites injected with JSRedir-R/Gumblar.  According to Sophos this malware accounted for approximately 42% of all infected websites detected in the last week, nearly 6 times its closest rival.

Although the infection method is not clear, given the variety of servers and platforms, it is most likely weak login credentials.

 More information is available at Sophos and the Unmask Parasites blog.


Update: Holger informed the ISC that the dropbox for this trojan, has been offline since last friday, but  a successor has come online, 

-- Rick Wanner -  rwanner at isc dot sans dot org


324 Posts
ISC Handler
May 18th 2009

Sign Up for Free or Log In to start participating in the conversation!