Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network

The Parrot traffic direction system (TDS) that came to light
earlier this year has had a larger impact than previously thought,
according to new research.

Sucuri, which has been tracking the same campaign since February
2019 under the name “NDSW/NDSX,” said that “the malware was one of
the top infections” detected in 2021, accounting for more than
61,000 websites.

Parrot TDS was documented^[1]
in April 2022 by Czech cybersecurity company Avast, noting that the
PHP script had ensnared web servers hosting more than 16,500
websites to act as a gateway for further attack campaigns.

This involves appending a piece of malicious code to all
JavaScript files on compromised web servers hosting content
management systems (CMS) such as WordPress that are in turn said to
be breached by taking advantage of weak login credentials and
vulnerable plugins.

Besides using different obfuscation tactics to conceal the code,
the “injected JavaScript may also be found well indented so that it
looks less suspicious to a casual observer,” Sucuri researcher
Denis Sinegubko said^[2].

JavaScript variant using the ndsj variable

The goal of the JavaScript code is to kick-start the second
phase of the attack, which is to execute a PHP script that’s
already deployed on the ever and is designed to gather information
about a site visitor (e.g., IP address, referrer, browser, etc.)
and transmit the details to a remote server.

Typical obfuscated PHP malware found in NDSW campaign

The third layer of the attack arrives in the form of a
JavaScript code from the server, which acts as a traffic direction
system to decide the exact payload to deliver for a specific user
based on the information shared in the previous step.

“Once the TDS has verified the eligibility of a specific site
visitor, the NDSX script loads the final payload from a third-party
website,” Sinegubko said. The most commonly used third-stage
malware is a JavaScript downloader named FakeUpdates^[3]
(aka SocGholish).

In 2021 alone, Sucuri said it removed Parrot TDS from nearly 20
million JavaScript files found on infected sites. In the first five
months of 2022, over 2,900 PHP and 1.64 million JavaScript files
have been observed containing the malware.

“The NDSW malware campaign is extremely successful because it
uses a versatile exploitation toolkit that constantly adds new
disclosed and 0-day vulnerabilities,” Sinegubko explained.

“Once the bad actor has gained unauthorized access to the
environment, they add various backdoors and CMS admin users to
maintain access to the compromised website long after the original
vulnerability is closed.”