Fort Disco

Posted: August 16, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	11,579
Threat Level:	2/10
Infected PCs:	1,754

First Seen:	August 16, 2013
Last Seen:	September 8, 2023
OS(es) Affected:	Windows

Fort Disco is a backdoor Trojan that uses the infected PC's resources to compromise weak password-protected websites, particularly those for blogs and those that use prominent brands of content management systems (such as WordPress, Drupal or Joomla). Although Fort Disco's campaign still is relatively young, Fort Disco already has compromised tens of thousands of separate PCs. These PCs also are subjected to various attacks, such as browser hijacks that redirect your browser to sites hosting drive-by-download attacks that may install further malware. SpywareRemove.com malware experts rate Fort Disco as a meaningful threat to both poorly-protected websites and PCs alike, and recommend anti-malware software for removing Fort Disco when such actions are warranted.

Fort Disco: Dancing into Your PC with the Worst of Intentions

Fort Disco is a young but already-widespread backdoor Trojan that conducts various attacks against the computer Fort Disco compromises – as well as against separate websites. Fort Disco's remote C&C server provides the list of websites to target, which largely consist of blogs and similar websites that are most likely to use easily-cracked password protection. Rather than attempting to steal passwords directly from the website owners, Fort Disco merely brute-force attacks the passwords by attempting to 'guess' them. Accordingly, SpywareRemove.com malware experts warn that websites with poor password security (such as very short passwords, passwords without a good mix of alphanumeric characters or passwords with common phrases like 'password1') are highly at risk for being cracked by Fort Disco. The purpose behind Fort Disco's attacks against these sites is not yet known, but most likely involves forcing these sites to host malicious contact that may infect your normal website traffic through various software vulnerabilities.

However, while that's the end of Fort Disco's story thus far for the websites Fort Disco attacks, the computers compromised by Fort Disco will continue to have other issues. One significant component often installed by Fort Disco is a browser hijacker that currently redirects Internet Explorer to a site hosting the Styx Exploit Kit. This attack may be used to install other malware on an already-infected PC without many, if any, symptoms of the installation ever taking place. A second component also associated with Fort Disco is a modified WordPress add-on that most likely is used to load additional malicious content pulled from Tumblr blogs.

Dancing Your Computer Off of Fort Disco's Floor

While Fort Disco has an unusually colorful name, Fort Disco is equally dangerous to your PC as any similar backdoor Trojan. PCs most often targeted by Fort Disco's campaign are located in Mexico, Peru or the Philippine islands. In contrast, the websites typically victimized in Fort Disco attacks usually are based in Russia or neighboring countries. For the latter, strong password security is the most obvious protection against Fort Disco – while PC users who suspect that their PCs are compromised by Fort Disco should be quick to resort to anti-malware software.

Fort Disco should not be anticipated to leave any visible symptoms of its attacks and, like most backdoor Trojans, is designed with the intention of concealing itself from the casual observation of the PC user. In fact, only a happenstance error on the part of the criminals managing Fort Disco's C&C server logging activity allowed the majority of the details of Fort Disco's campaign to be brought to light so early in its progression. Since Fort Disco's attacks clearly are only just beginning to ramp up, SpywareRemove.com malware experts advise continued caution against Fort Disco attacks for the foreseeable future.

Technical Details

Additional Information

The following URL's were detected:

fixchannel.site