Web hosting company GoDaddy has revealed that an unauthorized third party has accessed its servers and installed malware, causing intermittent redirects of its customers’ websites.
“In early December 2022, we began receiving complaints from a small number of customers that their websites were redirecting intermittently,” the company wrote. blog post on thursday.
“Once we confirmed the intrusion, we remedied the situation and implemented security measures to prevent future infections.”
GoDaddy added that it worked with law enforcement to confirm the attack was carried out by a “sophisticated and organized group” targeting various hosting services.
“According to the information we have received, their apparent goal is to infect websites and servers with malware to conduct phishing campaigns, malware distribution, and other malicious activities.”
Brad Hong, Customer Success Lead Horizon3.aiThe attackers didn’t “hack” how to break into GoDaddy, they said, but logged in using known compromised credentials, leaving an avenue for re-entry.
“This multi-year advanced and persistent threat actor group has long gone undetected after remediation and mitigation by GoDaddy’s many security measures. Past Data Leakage Incidentssaid Hong Information security on mail.
“As a standard, GoDaddy puts responsibility for their actions back on consumers, advising them to audit their own websites and trust GoDaddy’s security team after a breach of trust, while providing a free “Website Security Instead, we offered the Deluxe and Express Malware Removal service. I am strengthening my kingdom again and again. Maybe we should have used it ourselves? ”
GoDaddy does not provide detailed information about security breaches. 10K form It was filed with the U.S. Securities and Exchange Commission (SEC) on Thursday.
The incident comes weeks after a malicious campaign was discovered targeting victims in the Middle East and North Africa. Use of public cloud hosting services It hosts malicious CAB files and themed lures to entice Arabic speakers to open infected files.
