Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Gumblar malware's home domain is active again

Sites and PCs still infected with old malware may now receive new instructions

ScanSafe researchers are seeing renewed activity regarding Gumblar, a multifunctional piece of malware that spreads by attacking PCs visiting hacked Web pages.

Gumblar can steal FTP credentials as well as hijack Google searches, replacing results on infected computers with links to other malicious sites.

When the Gumblar malware was found in March, it looked for instructions on a server at gumblar.cn.

That domain was taken offline at the time, but has been reactivated within the last 24 hours, wrote Mary Landesman, a senior security researcher with ScanSafe, on a company blog.

Web sites that are infected with Gumblar contain an iframe, which is a way to bring content from one Web site into another.

Malware writers usually make those iframes invisible. When a victim visits the site, the iframe will launch a series of exploits hosted on a remote computer to try and hack the visiting machine.

Gumblar checks to see if the victim's PC is running unpatched versions of Adobe Systems' Reader and Acrobat programs. If so, the machine will be compromised by a so-called drive-by download.

Domain name registrars will often suspend domain names that have been used for malicious purposes, and malware writers will usually frequently change the domains their software looks to for instructions as those bad domains are blacklisted.

For some reason, the gumblar.cn domain was released and is in use again.

Landesman wrote that Web sites still infected with Gumblar may now be able to call back to the newly activated domain. It would allow those infected PCs to get updated with new malware.

"It's a mess," Landesman wrote. "Stay tuned."

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Adobe, Adobe Systems, Google
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: ScanSafe, malware, gumblar
Latest Blog Posts
Whitepapers
  • Increasing Uptime and Efficiency with Switched PDUs - Two ways to use rack PDUs for more than just distributing power
    Power distribution units (PDUs) play an essential role in delivering power safely and at appropriate voltages to servers and other network resources. A particular class of power distribution units known as rack Switched PDUs, however, is capable of performing additional functions that can help data center managers improve the efficiency and reliability of their IT infrastructure. This paper provides a brief introduction to rack Switched PDUs and describes two underappreciated yet powerful ways to take advantage of their advanced functionality.
    Learn more »
  • Oracle Database 11g for Data Warehousing and Business Intelligence
    Oracle Database 11g is a comprehensive database platform for data warehousing and business intelligence that combines industry-leading scalability and performance, deeplyintegrated analytics, and embedded integration and data-quality -- all in a single platform running on a reliable, low-cost grid infrastructure. Read on.
    Learn more »
  • Web 2.0 in the Workplace Today
    More than a decade after the term ‘Web 2.0’ was coined, many businesses are still nowhere near to taking full advantage of the collaborative technologies the term refers to. Undoubtedly, confidence is growing in relation to using tools such as Facebook, Skype, Twitter, and indeed many more organisations are using such technology now compared to even just a couple of years ago. But the fact remains that a worrying amount of businesses seem to be operating a ‘lockdown’ approach – an approach that I’m sure many Board-level staff know is simply not good for business in the long-term.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments

HP and IDG news, product videos and resources