7 minmedium
Many University Websites Used For Spam | Zscaler
Threat actors are compromising user accounts on university wiki-like services to host spam pages. These pages promote pharmaceutical spam, banking loans, and online casinos. The pages are distributed via email spam campaigns and hidden using URL shorteners. The vast number of university sub-domains managed by groups without professional IT security skills makes them an easy target.
Conf:highAnalyzed:2026-09-03openrouter
Showing defanged values
- domainadobe-discount[.]comFake store domain used for redirecting users from compromised university websites.
- domaingeneral-oem[.]comFake store domain used for redirecting users from compromised university websites.
- domainmmpsoftstore[.]comFake store domain used for redirecting users from compromised university websites.
- domainsuccessful-downloads[.]comFake store domain used for redirecting users from compromised university websites.
- domainsuccessful-software[.]comFake store domain used for redirecting users from compromised university websites.
- domainsuccessful-software[.]netFake store domain used for redirecting users from compromised university websites.
- domainterrific-software[.]comFake store domain used for redirecting users from compromised university websites.
- urlhxxp://alumni[.]iit[.]edu/s/946/forms/757/100824/game31[.]htmlSpam page hosted on a compromised IIT alumni server.
- urlhxxp://ccgps[.]eastern[.]edu/members/dstore/member-blog[.]blog2/items/Cialis-Viagra-OnlineSpam page hosted on a compromised Eastern University server.
- urlhxxp://cssa[.]grad[.]wustl[.]edu/sites/cssa[.]grad[.]wustl[.]edu/files/imce/user1208/ed60[.]pdfSpam content hosted on a compromised WUSTL server.
- urlhxxp://dingo[.]ucsf[.]edu/twiki/pub/People/EricAadnes/tab7[.]htmlSpam page hosted on a compromised UCSF TWiki instance.
- urlhxxp://foodfororegon[.]oregonstate[.]edu/sites/default/files/imagecache/al65[.]htmlSpam page hosted on a compromised Oregon State University website.
- urlhxxp://george[.]isc-seo[.]upenn[.]edu/ocladmin/ocl/uploads/204599[.]txtSpam content hosted on a compromised University of Pennsylvania server.
- urlhxxp://modular[.]math[.]washington[.]edu:9001/role?action=AttachFile&do=get&target=sl45Spam content hosted on a compromised University of Washington MoinMoin wiki.
- urlhxxp://nola[.]mit[.]edu/~cil/nolawiki/images/7/70/Amortizing-loan-calculator[.]pdfSpam page hosted on a compromised MIT wiki instance.
- urlhxxp://pkp[.]iit[.]edu/bog/l[.]php?n249=300Spam redirect link hosted on a compromised IIT server.
- urlhxxps://carmenwiki[.]osu[.]edu/download/attachments/16256437/tad44[.]htmlSpam page hosted on a compromised OSU Confluence instance (currently down).
- urlhxxps://confluence[.]cornell[.]edu/download/attachments/140416416/tab15[.]htmlSpam page hosted on a compromised Cornell Confluence instance.
- urlhxxps://wikis[.]uit[.]tufts[.]edu/confluence/download/attachments/29761132/ced46[.]htmlSpam page hosted on a compromised Tufts University Confluence instance.
- urlhxxp://wiki[.]nus[.]edu/download/attachments/76947595/doc11[.]htmlSpam page hosted on a compromised National University of Singapore Confluence instance.
- urlhxxp://writing[.]colostate[.]edu/files/personal/108957/File_0FFC8EF8-EC2C-2238-F165D3DC0AA636A9[.]txtSpam content hosted on a compromised Colorado State University server.
- urlhxxp://xserv1[.]umb[.]edu/groups/podcasts/wiki/ce448/attachments/cec02/xs57[.]htmlSpam page hosted on a compromised University of Massachusetts wiki.
Detection / Hunteropenrouter
What Happened
Attackers are breaking into accounts on university websites to post spam pages. These pages advertise fake pharmacies, loans, and casinos. The spam is sent out through email campaigns, using link shorteners to hide the real website address. Universities are targeted because they have many sub-websites run by different groups that may not have strong security teams. People should be cautious of links in unsolicited emails, even if they appear to come from a university.
Key Takeaways
- Compromised user accounts on university wiki and confluence services are being used to host spam pages.
- Spam content includes pharmaceutical products like Viagra and Cialis, banking loans, and online casinos.
- Spam pages are hidden using URL shorteners and distributed via email spam campaigns.
- University sub-domains are targeted due to the lack of professional IT/Security skills among different managing groups.
- Fake store domains like adobe-discount.com and successful-software.com are still active and redirecting users.
Affected Systems
- University wiki services
- Confluence instances
- MoinMoin wiki instances
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Threat actors compromise user accounts on university wiki-like services.
- Persistence: Spam pages and files are uploaded to the compromised services.
- Delivery: Spam emails are sent containing links to the uploaded content, often hidden by URL shorteners.
- Redirection: Some compromised university sites redirect users to fake store domains.
- Monetization: Users are tricked into purchasing counterfeit software or pharmaceutical products.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | The article describes web-based compromise of wiki and confluence services, not endpoint compromise. |
| Network Visibility | Medium | Network monitoring could detect traffic to known fake store domains or anomalous access patterns to wiki upload endpoints. |
| Detection Difficulty | Moderate | Detecting compromised accounts requires monitoring for anomalous upload behavior or content changes on wiki platforms, which may generate false positives in legitimate collaborative environments. |
Required Log Sources
- Web server access logs
- Confluence/Wiki application logs
- Email gateway logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for anomalous file uploads to wiki or confluence instances by accounts that do not typically upload files. | Web application logs, file upload audit logs | Persistence | Medium - legitimate users may upload files infrequently, leading to false positives. |
| Consider hunting for access to URLs on university domains that contain suspicious file extensions or patterns indicative of spam pages. | Web server access logs, proxy logs | Delivery | Low - specific URL patterns associated with spam are unlikely to be accessed legitimately. |
| Consider hunting for email campaigns containing shortened URLs that redirect to university domains. | Email gateway logs, URL sandbox detonation logs | Delivery | Low - legitimate university links in emails are common, but shortened URLs redirecting to specific file paths are suspicious. |
Control Gaps
- Standard endpoint controls would not detect this web-based compromise.
- URL filtering may allow traffic to reputable university domains, even if hosting spam.
Key Behavioral Indicators
- Anomalous file upload activity on wiki or confluence platforms
- Presence of pharmaceutical or gambling-related keywords in uploaded file names or content
- Redirects from university domains to known fake store domains
False Positive Assessment
Medium - University domains are typically trusted, which may lead to false negatives in URL filtering. Detecting anomalous uploads requires tuning to avoid flagging legitimate collaborative activity.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing web server and application logs for unauthorized file uploads or content modifications on any wiki or confluence instances.
- Consider blocking the identified fake store domains at the network perimeter.
Infrastructure Hardening
- Evaluate whether multi-factor authentication can be enforced for all accounts with upload privileges on wiki or confluence platforms.
- Consider implementing stricter file upload validation and content scanning on collaborative platforms.
User Protection
- Consider deploying web content filtering that can analyze page content for spam indicators, even on reputable domains.
- If supported by your email gateway, consider enabling enhanced URL rewriting and sandboxing for links in incoming emails.
Security Awareness
- Consider reminding users to be cautious of links in unsolicited emails, even if they appear to come from reputable educational institutions.
- Consider training users to recognize signs of pharmaceutical spam and fake online stores.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Initial Access
Tactic
Impact
Additional IOCs
- Urls:
hxxp://nola[.]mit[.]edu/~cil/nolawiki/images/7/70/Amortizing-loan-calculator.pdf- Spam page hosted on a compromised MIT wiki instance.hxxps://confluence[.]cornell[.]edu/download/attachments/140416416/tab15.html- Spam page hosted on a compromised Cornell Confluence instance.hxxp://dingo[.]ucsf[.]edu/twiki/pub/People/EricAadnes/tab7.html- Spam page hosted on a compromised UCSF TWiki instance.hxxp://george[.]isc-seo[.]upenn[.]edu/ocladmin/ocl/uploads/204599.txt- Spam content hosted on a compromised University of Pennsylvania server.hxxp://xserv1[.]umb[.]edu/groups/podcasts/wiki/ce448/attachments/cec02/xs57.html- Spam page hosted on a compromised University of Massachusetts wiki.hxxp://writing[.]colostate[.]edu/files/personal/108957/File_0FFC8EF8-EC2C-2238-F165D3DC0AA636A9.txt- Spam content hosted on a compromised Colorado State University server.hxxp://foodfororegon[.]oregonstate[.]edu/sites/default/files/imagecache/al65.html- Spam page hosted on a compromised Oregon State University website.hxxps://carmenwiki[.]osu[.]edu/download/attachments/16256437/tad44.html- Spam page hosted on a compromised OSU Confluence instance (currently down).hxxp://cssa[.]grad[.]wustl[.]edu/sites/cssa.grad.wustl.edu/files/imce/user1208/ed60.pdf- Spam content hosted on a compromised WUSTL server.hxxp://ccgps[.]eastern[.]edu/members/dstore/member-blog.blog2/items/Cialis-Viagra-Online- Spam page hosted on a compromised Eastern University server.hxxp://modular[.]math[.]washington[.]edu:9001/role?action=AttachFile&do=get&target=sl45- Spam content hosted on a compromised University of Washington MoinMoin wiki.hxxps://wikis[.]uit[.]tufts[.]edu/confluence/download/attachments/29761132/ced46.html- Spam page hosted on a compromised Tufts University Confluence instance.hxxp://wiki[.]nus[.]edu/download/attachments/76947595/doc11.html- Spam page hosted on a compromised National University of Singapore Confluence instance.hxxp://alumni[.]iit[.]edu/s/946/forms/757/100824/game31.html- Spam page hosted on a compromised IIT alumni server.hxxp://pkp[.]iit[.]edu/bog/l.php?n249=300- Spam redirect link hosted on a compromised IIT server.
- Other:
+1 800 532 4869- US toll-free phone number listed on a spam landing page advertising pharmaceutical products.+1 718 313 1498- US phone number listed on a spam landing page advertising pharmaceutical products.+44 200 222 7048- UK phone number listed on a spam landing page advertising pharmaceutical products.
Related
Stay currentSubscribe via RSS
