Two Gov Websites Compromised
Hi, I'm RelunSec
i saw in my today threat intelligence research, two gov websites serving adwares compromised by threat actors likely russia, but without further info you cannot attribute correctly their nation
hxtp://ppa-or[.]gov/: Portland Police Association area in Oregon http://reevescountyesdtx[.]gov/: Reeves County Emergency Services Districts
All those sites redirecting to unwanted unrelated third party sites Interesting we saw something anormal those compromised sites are setupping random subdomains, on the next day of our threat intelligence https://google.com/search?q=site:reevescountyesdtx.gov contains 400 search results whiches anormal for a state local enforcement site, random meaningless subdomains, that was highly interesting, it is likely something worse happend https://www.google.com/search?q=site:ppa-or.gov The samething for that domain contain random subdomains names That may suggest the compromise of their domain provider, not just the main website itself, because that was anormal those thousands random meaningless subdomains for a local gov websites, local gov website alywas use clear subdomains names that have meanings