← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Thousands of Sites with Popup Builder Compromised by Balada Injector
WHITE Balada Tr1sa111 2024-01-16 Modified: 2024-02-14
44
IOCs
MEDIUM VOLUME
popup builderwordpresscloudflaredecemberbalada injectornnnnjanuarybaladajavascriptwpscanbalada javascriptsitecheck
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Balada JavaScript Popup Builder SiteCheck
Indicators of Compromise (5 / 44 total)
All URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
URL http://get.specialcraftbox.com/loc/gr.txt — 2024-01-16
URL https://get.specialcraftbox.com/loc/r.php?zd= — 2024-01-16
URL https://rest.greenfastline.com/vkRJGzsp — 2024-01-16
URL https://soft.specialcraftbox.com/JZFYbC — 2024-01-16
URL https://soft.specialcraftbox.com/KQGrXb?c= — 2024-01-16
References (1)
↗ https://blog.sucuri.net/2024/01/thousands-of-sites-with-popup-builder-compromised-by-balada-injector.html