{ "id": "3192802b-4882-4f45-b8d6-b5c9dd7ce099", "created_at": "2026-04-06T00:08:23.155922Z", "updated_at": "2026-04-10T03:28:20.873274Z", "deleted_at": null, "sha1_hash": "7055e17ac06753e78cab1d819fe0412dc15d55ab", "title": "Op EvilTraffic - Thousands of compromised sites involved in a malvertising campaign", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1701631, "plain_text": "Op EvilTraffic - Thousands of compromised sites involved in a\r\nmalvertising campaign\r\nBy Pierluigi Paganini\r\nPublished: 2018-01-22 · Archived: 2026-04-02 12:03:01 UTC\r\nOp EvilTraffic CSE CybSec ZLAB Malware Analysis Report – Exclusive, tens of\r\nthousands of compromised sites involved in a new massive malvertising campaign\r\nMalware experts at CSE Cybsec uncovered a massive malvertising campaign\r\ndubbed EvilTraffic leveraging tens of thousands compromised websites. Crooks\r\nexploited some CMS vulnerabilities to upload and execute arbitrary PHP pages\r\nused to generate revenues via advertising.\r\nIn the last days of 2017, researchers at CSE Cybsec observed threat actors exploiting some CMS vulnerabilities to\r\nupload and execute arbitrary PHP pages used to generate revenues via advertising. The huge malvertising\r\ncampaign was dubbed EvilTraffic\r\nhttp://securityaffairs.co/wordpress/68059/cyber-crime/eviltraffic-malvertising-campaign.html\r\nPage 1 of 4\n\nThe compromised websites involved in the EvilTraffic campaign run various versions of the popular WordPress\r\nCMS. Once a website has been compromised, attackers will upload a “zip” file containing all the malicious files.\r\nDespite the “zip” file has different name for each infection, when it is uncompressed, the files contained in it have\r\nalways the same structure. We have found some of these archives not used yet, so we analyzed their content.\r\nThe malicious files are inserted under a path referring probably different versions of the same malware (“vomiu”,\r\n“blsnxw”, “yrpowe”, “hkfoeyw”, “aqkei”, “xbiret”, “slvkty”).\r\nUnder this folder there are:\r\na php file, called “lerbim.php”;\r\na php file, that has the same name of the parent dir; it has initially “.suspected” extension and only in a\r\nsecond time, using “lerbim.php” file, it would be changed in “.php” file;\r\ntwo directories, called “wtuds” and “sotpie”, containing a series of files.\r\nAn example of this structure is shown in the following figure:\r\nThe main purpose of the “malware” used in the EvilTraffic campaign is to trigger a redirecting chain through at\r\nleast two servers which generate advertising traffic.\r\nThe file “{malw_name}.php” becomes the core of all this context: if it is contacted by the user through the web\r\nbrowser, it redirects the flow first to “caforyn.pw” and then to “hitcpm.com”, which acts as a dispatcher to\r\ndifferent sites registered to this revenue chain.\r\nhttp://securityaffairs.co/wordpress/68059/cyber-crime/eviltraffic-malvertising-campaign.html\r\nPage 2 of 4\n\nThese sites could be used by attackers to offer commercial services that aim to increase traffic for their customers,\r\nbut this traffic is generated in an illegal way by compromising websites. The sites could host also fraudulent pages\r\nwhich pretend to download suspicious stuff (i.e. Toolbars, browser extensions or fake antivirus) or steal sensitive\r\ndata (i.e. credit card information).\r\nIn order to increase the visibility of the web, the compromised sites must have a good page-rank on search\r\nengines. So, the malware performs SEO Poisoning by leveraging on wordlist containing the trending searched\r\nwords\r\nThe population of the compromised site with the wordlists and their relative query results is triggered contacting\r\nthe main PHP using a specific User-Agent on a path “{malw_name}/{malw_name}.php?vm={keyword}”.\r\nResearchers from CSE CybSec ZLab discovered roughly 18.100 compromised websites.\r\nWhile researchers were analyzing the EvilTraffic malvertising campaign, they realized that most of the\r\ncompromised websites used in the first weeks of the attacks have been cleaned up in the last days.  just in one\r\nweek, the number of compromised websites dropped from around 35k to 18k.\r\nAccording to Alexa Traffic Rank, hitcpm.com is ranked number 132 in the world and 0.2367% of global Internet\r\nusers visit it. Below are reported some traffic statistics related to hitcpm.com provided by hypestat.com\r\nDaily Unique Visitors 1,183,500\r\nMonthly Unique Visitors 35,505,000\r\nPages per visit 1.41\r\nDaily Pageviews 1,668,735\r\nThe analysis of the traffic shows an exponential increase in the traffic during October 2017.\r\nhttp://securityaffairs.co/wordpress/68059/cyber-crime/eviltraffic-malvertising-campaign.html\r\nPage 3 of 4\n\nExperts discovered that crooks behind the Operation EvilTraffic used a malicious software to hijack traffic, it acts\r\nas brows a browser hijacker. The malware is distributed via various methods, such as:\r\nAttachment of junk mail\r\nDownloading freeware program via unreliable site\r\nOpen torrent files and click on malicious links\r\nBy playing online games\r\nBy visiting compromised websites\r\nThe main purpose of the malware is to hijack web browsers changing browser settings such as DNS, settings,\r\nhomepage etc. in order to redirect as more traffic as possible to the dispatcher site.\r\nFurther technical details about this campaign, including IoCs, are available in the report titled:\r\n“Tens of thousands of compromised web sites involved in new massive malvertising campaign”\r\nYou can download the full ZLAB Malware Analysis Report at the following URL:\r\nhttp://csecybsec.com/download/zlab/20180121_CSE_Massive_Malvertising_Report.pdf\r\n[adrotate banner=”9″] [adrotate banner=”12″]\r\nPierluigi Paganini\r\n(Security Affairs – malvertising campaign, EvilTraffic)\r\n[adrotate banner=”5″]\r\n[adrotate banner=”13″]\r\nSource: http://securityaffairs.co/wordpress/68059/cyber-crime/eviltraffic-malvertising-campaign.html\r\nhttp://securityaffairs.co/wordpress/68059/cyber-crime/eviltraffic-malvertising-campaign.html\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "references": [ "http://securityaffairs.co/wordpress/68059/cyber-crime/eviltraffic-malvertising-campaign.html" ], "report_names": [ "eviltraffic-malvertising-campaign.html" ], "threat_actors": [ { "id": "e978612c-9ece-4d01-acdd-04d64be599d0", "created_at": "2023-01-06T13:46:38.833205Z", "updated_at": "2026-04-10T02:00:03.115965Z", "deleted_at": null, "main_name": "EvilTraffic", "aliases": [ "Operation EvilTraffic" ], "source_name": "MISPGALAXY:EvilTraffic", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434103, "ts_updated_at": 1775791700, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/7055e17ac06753e78cab1d819fe0412dc15d55ab.pdf", "text": "https://archive.orkl.eu/7055e17ac06753e78cab1d819fe0412dc15d55ab.txt", "img": "https://archive.orkl.eu/7055e17ac06753e78cab1d819fe0412dc15d55ab.jpg" } }