The database – located on a server based in Hong Kong, operated by Russians and administered from Amsterdam, Netherlands – contained usernames, passwords and server addresses that could grant access to at least 2,000 sites in the United States, including at least a dozen Fortune 500 companies and several government agencies, said Iftach Amit, director of security research at Finjan.
The credentials were being used by the hackers to access and infect legitimate websites with malicious code, but they also were being sold to other criminals through the underground market, Amit told SCMagazineUS.com.
Each credential was listed with a price tag, determined by the Google page-ranking of the website the information could be used to compromise, Amit said.
The credentials enable cybercriminals to gain access to websites to inject IFRAME tags into webpages, which can redirect the client's browser to a malicious server.
The Finjan researchers stumbled across the application after tracking a number of trusted websites that contained code pointing to the overseas server, which also was hosting a crimeware toolkit being used to distribute malware.
Amit said organisations are welcome to contact Finjan to determine if their FTP credentials were listed on the database. In the meantime, the company has contacted numerous law enforcement agencies, including the FBI.
An agency spokesman could not confirm whether the FBI was investigating.
See original article on scmagazineus.com
Finjan finds application selling FTP credentials
Researchers at the web security firm Finjan on Wednesday announced they have discovered a small database containing about 8,700 file-transfer protocol (FTP) server credentials that were being used to plant malicious code on legitimate websites.
Add iTnews as your trusted source
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
.jpg&h=140&w=231&c=1&s=0)
Promoted Content
Australian mid-market businesses to access deeper AI and security expertise with First Focus-Integris partnership
.jpg&h=140&w=231&c=1&s=0)
Partner Content
Who owns your brand’s AI reputation?
Promoted Content
How David Jones, Canva and others are putting agentic AI to work
.jpg&h=140&w=231&c=1&s=0)
Partner Content
From data overload to decisive action – accelerating decisions with AI agents
.png&w=100&c=1&s=0)
Cloud Resilience Summit
iTnews Benchmark Security Awards 2026
iTnews State of Security Breakfast Sydney
iTnews Executive Retreat - Security Leaders Edition - VIC
