ESET, a digital-security company with U.S. headquarters in San Diego, said Tuesday its security research team in collaboration with other organizations had uncovered a widespread cyber-criminal campaign that has seized control of some 10,000 web servers worldwide.
Once infected, victims’ systems are used to steal credentials, redirect web traffic to malicious content and send as many as 35 million spam messages per day.
“Windigo has been gathering strength, largely unnoticed by the security community, for more than two and a half years and currently has 10,000 servers under its control,” said Pierre-Marc Bureau, ESET’s security intelligence program manager. “This number is significant if you consider each of these systems have access to significant bandwidth, storage, computing power and memory.”
The attack, which has been dubbed “Operation Windigo” by security experts, hijacks servers, infects the computers that visit them and steals information from victims. The infected servers are then used to redirect half a million web visitors to malicious content on a daily basis.
Servers located throughout the U.S., Germany, France and the United Kingdom are among those infected.
With more than 60 percent of the world’s websites running on Linux servers, ESET researchers are warning webmasters and system administrators to check their systems to see if they have been compromised. The company published a detailed technical report Tuesday presenting the findings of the teams’ investigations.
If administrators discover their systems are infected, they are advised to wipe affected computers and reinstall the operating system and software.
— From an ESET press release
