{"id":1656,"date":"2025-01-18T19:13:06","date_gmt":"2025-01-18T19:13:06","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/18\/heres-a-rewritten-title-in-50-60-characters-maxpython-bots-target-php-gambling-siteslet-me-know-if-youd-like-any-further-adjustments\/"},"modified":"2025-01-18T19:13:08","modified_gmt":"2025-01-18T19:13:08","slug":"heres-a-rewritten-title-in-50-60-characters-maxpython-bots-target-php-gambling-siteslet-me-know-if-youd-like-any-further-adjustments","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/heres-a-rewritten-title-in-50-60-characters-maxpython-bots-target-php-gambling-siteslet-me-know-if-youd-like-any-further-adjustments\/","title":{"rendered":"Here’s a rewritten title in 50-60 characters max:\n\n“Python Bots Target PHP-Gambling Sites”\n\nLet me know if you’d like any further adjustments!"},"content":{"rendered":"\n<\/p>\n

New Botnet Campaign Targets PHP-Based Web Servers in Indonesia<\/strong><\/p>\n

Date:<\/strong> January 17, 2025<\/p>\n

Author:<\/strong> Ravie Lakshmanan<\/p>\n

Categories:<\/strong> Web Security, Botnet<\/p>\n

<\/a><\/div>\n

A New Botnet Campaign Targets PHP-Based Web Servers in Indonesia<\/strong><\/p>\n

Cybersecurity researchers have exposed a new campaign that targets web servers running PHP-based applications to promote gambling platforms in Indonesia. Over the past two months, a significant volume of attacks from Python-based bots has been observed, suggesting a coordinated effort to exploit thousands of web apps.<\/p>\n

According to Imperva researcher Daniel Johnston, "These attacks appear tied to the proliferation of gambling-related sites, potentially as a response to the pktoto[.]cc," a known Indonesian gambling site. Johnston further stated, "Over the past two months, a significant volume of attacks from Python-based bots has been observed, suggesting a coordinated effort to exploit thousands of web apps."<\/p>\n

Malware Campaign Revealed<\/strong><\/p>\n

Recently, a widespread malware campaign was revealed that has targeted over 5,000 sites globally to create unauthorized administrator accounts, install a malicious plugin from a remote server, and siphon credential data back to it. The exact initial access vector used to deploy the JavaScript malware on these sites is presently not known. The malware has been codenamed WP3.XYZ in reference to the domain name that’s associated with the server used to fetch the plugin and exfiltrate data ("wp3[.]xyz").<\/p>\n

Mitigation Measures<\/strong><\/p>\n

To mitigate against the attack, it’s recommended that WordPress site owners keep their plugins up-to-date, block the rogue domain using a firewall, scan for suspicious admin accounts or plugins, and remove them.<\/p>\n

Stay Informed<\/strong><\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i> and LinkedIn to read more exclusive content we post.<\/p>\n