https://www.botnets.fr/index.php?action=history&feed=atom&title=Dutch_users_served_Sinowal_for_lunch 2026-10-24T22:13:24Z Revision history for this page on the wiki MediaWiki 1.43.11 https://www.botnets.fr/index.php?title=Dutch_users_served_Sinowal_for_lunch&diff=5812&oldid=prev 2015-08-05T20:13:15Z

<p>Text replacement - &quot; blog.trendmicro.com&quot; to &quot;&quot;</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 20:13, 5 August 2015</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l5">Line 5:</td> <td colspan="2" class="diff-lineno">Line 5:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Licence=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Licence=</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Video=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Video=</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://blog.trendmicro.com/dutch-users-served-sinowal-for-lunch/ <del style="font-weight: bold; text-decoration: none;">blog.trendmicro.com</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://blog.trendmicro.com/dutch-users-served-sinowal-for-lunch/</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Roland Dela Paz,  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Roland Dela Paz,  </div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Malware Blog</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Malware Blog</div></td></tr> <!-- diff cache key wiki:diff:1.41:old-2097:rev-5812:php=table --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=Dutch_users_served_Sinowal_for_lunch&diff=2097&oldid=prev 2015-02-07T14:23:55Z

<p>1 revision imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:23, 7 February 2015</td> </tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr> <!-- diff cache key wiki:diff:1.41:old-2096:rev-2097 --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=Dutch_users_served_Sinowal_for_lunch&diff=2096&oldid=prev 2012-08-18T15:35:02Z

<p></p> <p><b>New page</b></p><div>{{Publication<br /> |Image=Dutch users served Sinowal for lunch.png<br /> |Legend=<br /> |Document=<br /> |Licence=<br /> |Video=<br /> |Link=http://blog.trendmicro.com/dutch-users-served-sinowal-for-lunch/ blog.trendmicro.com<br /> |Author=Roland Dela Paz, <br /> |NomRevue=Malware Blog<br /> |Date=March 20 2012<br /> |Editor=TrendMicro<br /> |Year=2012<br /> |ISBN=<br /> |Page=<br /> |Abstract=Dutch users were recently targeted in a website compromise that involved a popular news site in the Netherlands, nu.nl. The site was compromised and modified to load a malicious iframe that resulted to visitors’ systems being infected with a SINOWAL variant.<br /> <br /> Trend Micro researcher Feike Hacquebord says that considering the different characteristics of this attack, it seems like it was specifically designed to affect Dutch users. Aside from the affected site being one of the most popular sites in their country, the scripts inserted in the website were activated right before lunch time in the Netherlands — a time when Dutch users usually utilize to check the news and other sites while in the office.<br /> <br /> According to nu.nl’s released statement, they believe that attackers exploited a vulnerability on the news group’s Content Management Systems (CMS), allowing them to insert 2 scripts — g.js and gs.js — in nu.nl’s subdomain.<br /> |Botnet=Sinowal, <br /> |Malware=, <br /> |ExploitKit=Blackhole<br /> |CCProtocol=, <br /> |Operation=, <br /> |Keyword=Blackhole, <br /> }}</div>

Eric.freyssinet