Parrot TDS: Understanding the Payload Distribution that injects malicious scripts into existing JavaScript code on compromised websites

Parrot TDS (traffic direction system), a stealthy cyber campaign discovered by Palo Alto researchers, has evolved its tactics from basic code injection to dynamic and targeted methods. Websites infected with Parrot TDS inject malicious scripts into legitimate JavaScript, redirecting visitors to phishing scams, malware downloads, or unwanted content. This post summarizes the Palo Alto findings and provides more detailed technical recommendations to assist large enterprises with their cyber defense strategy.

Parrot TDS Payload Distribution

• Exploit Vulnerabilities

Attackers exploit vulnerabilities in popular CMS platforms such as WordPress and Joomla, injecting malicious code (often containing keywords like “ndsj” or “ndsw”) into existing JavaScript files.

• Initial Contact

With the injection of malicious code into existing JavaScript files on the compromised server, an unsuspected victim browses the compromised website.

• Deliver the Landing Script

While the victim is browsing the compromised web server, it returns with a malicious landing script. Additionally, the landing script conducts environment checks to avoid detection.

• Query the Payload Server

Once the conditions set by the landing script are successfully met, the victim’s web browser queries a payload server. 

• Retrieve the Payload

The server then returns a payload script per the landing script’s request. This script is a JavaScript payload containing keywords such as ‘ndsx.’

• Complete the Attack. 

The payload script successfully directs the victim’s browser to the intended malicious content, fulfilling the attacker’s goals.

Recommendations

Here are actionable recommendations to defend against  this evolving threat:

• Use extensions that block scripts.

Use adblockers to stop malicious code from being executed through advertisements, lowering the danger of drive-by compromises. In addition, use a script-blocking extension to reduce the execution of scripts, especially malicious JavaScripts and HTA files frequently utilized during exploitation operations. Keep these extensions updated and maintained regularly to adjust to changing threat landscapes.

• Prioritize timely patching of CMS vulnerabilities. Particularly, prioritize WordPress and Joomla. Leverage automated patching solutions and vulnerability scanners to promptly identify and address critical flaws. Scan beyond web servers to include all connected devices and applications within on-premises, cloud, and SaaS environments. This holistic approach ensures no entry points are missed.

• Fully utilize web application firewalls (WAFs). Make use of a WAF that is set up to recognize and prevent attempts at malicious code injection. These rules should be focused on spotting suspicious JavaScript code signatures and irregularities in server-side scripting activity. Consider cloud-based WAF solutions to ensure complete protection in a hybrid environment. Use runtime application self-protection (RASP). Set up reliable and high-end RASP solutions to keep an eye on the behavior of applications during runtime and identify malicious injections instantly, stopping them from executing even if they manage to get past WAFs.

• Type-based blocking of content. Consider preventing the execution, transfer, and download of unusual file formats connected to malicious campaigns. Examine and update the prohibited file type list for new threats and threat intelligence. Work with security vendors to remain current on new file formats that attackers may be using. It is advisable to incorporate code signing and integrity checking for server-side scripts to authenticate them, prohibit unauthorized alterations, and minimize the risk of dynamic injection attacks.

• Implement Domain Name System (DNS) security measures. Use DNSSEC and other Domain Name System (DNS) security mechanisms to verify the authenticity of DNS answers and stop phishing site redirections. Create local DNS sinkholes to sabotage dynamic resolution-related activities, such as domain generation algorithms (DGAs). Use sinkholing to lower the cost of DGAs and stop them from communicating with malicious sites. Update sinkhole setups frequently regarding observed adversary strategies and threat intelligence such as the ones revealed in Parrot TDS campaign.