PARSED CONTENT

The domain had the following in the web site, "Unusual njRat campaign originating from Saudi Arabia using FakeAV tactics." I analyzed that the web site stated " While investigating an unrelated threat I ran into a rather interesting njRat campaign." They also stated " It started with a website that was compromised and being abused as a 3rd layer C2 communication proxy. It seems those guys werent the only ones using it. When visiting the websites main page I was greeted with an alert pop-up. Initial infection chain for Angler." The meta header had exploit as the first search term. This keyword was followed by kit, fiesta, and exploitkit which isn't as important as exploit. The other words they uses is backdoor.