Ars Technica compromised. Come read the story at Ars Technica!

It’s also not clear that any Ars users visited the about page.

Are weblogs not a thing? They should be able to tell how many times that page was accessed and by whom with a single query.

Damn, that's pretty cool actually.

This is the best summary I could come up with:

Ars Technica was recently used to serve second-stage malware in a campaign that used a never-before-seen attack chain to cleverly cover its tracks, researchers from security firm Mandiant reported Tuesday.

A benign image of a pizza was uploaded to a third-party website and was then linked with a URL pasted into the “about” page of a registered Ars user.

The campaign came from a threat actor Mandiant tracks as UNC4990, which has been active since at least 2020 and bears the hallmarks of being motivated by financial gain.

Opening the same file in a hex editor—a tool for analyzing and forensically investigating binary files—showed that a combination of tabs, spaces, and new lines were arranged in a way that encoded executable code.

The base 64 strings in the image URL or video description, in turn, caused the malware to contact a site hosting the second stage.

Anyone who is concerned they may have been infected by any of the malware covered by Mandiant can check the indicators of compromise section in Tuesday’s post.

The original article contains 675 words, the summary contains 173 words. Saved 74%. I'm a bot and I'm open source!