The website of a large company dealing in simulation software and engineering systems has been hacked with malicious codeto collect information about visitors.
This could mean that the attackers are planning a large-scale attack, given that the company's customers are from sectors such as automotive, aerospace, and construction.
The code on the website loads a malicious JavaScript file, dubbed Scanbox by the attackers, from a remote server.
According to Jaime Blasco from Alien Vault, Scanbox's behavior includes configuring the C&C server where information about visitors is stored and collecting data about the referrer, the browser used, the geographical location, the content of the website the user is visiting, screen size values, operating systems and languages.
Apart from that, the tool also collects data about the security software available on the system, along with the products that are commonly targeted by web-based exploits to install malware.
Blasco also claims that Scanbox performs keylogging functions, recording all the victim's keystrokes on the website. This could be useful for recording the victim's interests through search queries.
All information sent to the C&C server is protected through encoding and encryption.
