Redirection Roulette (Campaign)

Beginning in early September 2022, an unknown actor compromised tens of thousands of websites primarily targeting East Asian audiences and redirected hundreds of thousands of visitors to adult-themed pages. The attacker often used legitimate FTP credentials to connect to web servers; the source of those credentials and the initial access method remain unknown. Wiz recommends using FTPS/SFTP with strong credentials, rotating credentials, reinstalling software from trusted sources, and restoring affected assets to clean versions.