Container-focused cyberattackers have a brand-new type of payload: a gray-area traffic-generating tool that creates artificial page views for websites, known as the 9hits Traffic Exchange.
The app loads a chosen webpage a certain number of times, thus generating page views - even though there are no actual eyeballs taking in the target site's content.
9hits might be a little shady, being used to inflate a site's actual visitor engagement numbers in a quest for luring advertisers - but its use is not illegal.
Unless, of course, it's being planted into an organization's infrastructure without consent, thus stealing compute resources.
Cado says the attackers in a fresh campaign are targeting vulnerable Docker services to deploy two separate containers: an XMRig cryptominer and 9hits.
The former is a well-known malicious payload, but the latter is entirely novel, the researchers said.
Once visited, the session owner is awarded a credit on the 9hits platform.
The credits can then be turned into traffic to the attacker's site of choice, which in turn can be monetized in any number of creative ways, including selling it to an ad network.
This Cyber News was published on www.darkreading.com. Publication date: Thu, 18 Jan 2024 20:20:10 +0000