Amnesty International's UK website compromised to infect visitors with cyberspying malware

11.05.2012
The U.K. website of Amnesty International, a human rights watchdog organization, was compromised by hackers, who used it to infect visitors with a remote access Trojan horse program known as Gh0st RAT, security firm Websense reported on Friday.

Websense's automated malware scanners detected the compromise on the on Tuesday and Wednesday, Websense security researcher Gianluca Giuliani, said in a on Friday. The attackers managed to inject malicious code that attempted to exploit a Java vulnerability known as CVE-2012-0507 into the site's homepage, he said.

The same vulnerability was exploited earlier this year to infect more than 600,000 Mac computers with the Flashback malware. It was patched in Java for Windows back in February and in Java for Mac in April.

The exploit code used in this attack appears to have been copied from Metasploit, an open source penetration testing framework popular among security professionals, Giuliani said.

The exploit was designed to install a version of Gh0st RAT, a computer Trojan horse that is usually associated with targeted attacks. However, the company believes that this compromise was the result of larger Web attack campaign.

Websense detected over 100 other websites infected with the same malicious code as Amnesty International's U.K. website during the same time period, Carl Leonard, senior manager of Websense Security Labs, said.