Two Gov Websites Compromised

Hi, I'm RelunSec

i saw in my today threat intelligence research, two gov websites serving adwares compromised by threat actors likely russia, but without further info you cannot attribute correctly their nation

hxtp://ppa-or[.]gov/: Portland Police Association area in Oregon http://reevescountyesdtx[.]gov/: Reeves County Emergency Services Districts

All those sites redirecting to unwanted unrelated third party sites

7 points | by relunsec 14 hours ago

1 comments

  • relunsec 51 minutes ago
    Interesting we saw something anormal those compromised sites are setupping random subdomains, on the next day of our threat intelligence

    https://google.com/search?q=site:reevescountyesdtx.gov contains 400 search results whiches anormal for a state local enforcement site, random meaningless subdomains, that was highly interesting, it is likely something worse happend

    https://www.google.com/search?q=site:ppa-or.gov The samething for that domain contain random subdomains names

    That may suggest the compromise of their domain provider, not just the main website itself, because that was anormal those thousands random meaningless subdomains for a local gov websites, local gov website alywas use clear subdomains names that have meanings