SIOS: a malicious file planted through a site upload page closed the group's websites for two weeks

1. 2019-12-23 21:00

   An internal check found malicious files under the upload page the subsidiary used to exchange data with a customer, and both companies' sites were closed. [1]

2. 2020-01-05 17:00

   The sites went back online after moving to a safer server. [1]

3. 2020-01-06

   Public disclosure. [1] [2]

4. 2020-02-03

   The findings of an outside expert were published. [3]

The only file confirmed as malicious was a webshell, and it did not run because its code was incomplete. There was no sign of suspicious remote logins or files being taken, so the company concluded no data had leaked. [3]

The upload system was separated from the web server and given authentication, and the company said it would run regular vulnerability tests and use several anti-malware tools. [3]