Inkrainbow/Pocketbloke Hackers

Very recently I have been getting quite a lot of sites hacked by guys who leave an include in files like js and php files. This include calls a script from their own servers located at inkrainbow.ru and pocketbloke.ru.

I’m not entirely sure exactly what the script does, but it seems that they get into the sites via FTP. Which means that my PC must have been infected by a trojan which has been sending them my details. I have so far spoken to another developer and have also seen a comment on another blog post about the same guys, here, which suggest that the trojan targets Filezilla specifically and that way gets all the saved login details to your sites. If you follow that link to Nate Stillers blog you will get some good advice on what to look for.

What I have been doing up until now is just to download all images and template folders, delete the entire installation, then re-upload the images and template folders to the CMS systems. Then I go about changing all the FTP login details as well as the admin login details on the systems themselves.

So far I have had WordPress, Joomla and just plain html sites hacked. I have also downloaded a nifty little application called UnHackMe, which helps with detecting rootkits and trojans which your normal anti-virus won’t pick up.

Hope this helps someone as I have not seen many posts so far about these guys. I you have anything to add, please comment here or on Nate’s Blog post.

In: On the Web

Tags: hackers, rootkit, trojan, web design, Web Designer, web developer, web hosting