Originally published: 12/03/2024
LandUpdate808 is a malicious downloader that distributes malicious payloads disguised as fake browser updates. The downloader is usually hosted on malicious or compromised websites. LandUpdate808 was identified by the Center for Internet Security as a top-ten observed malware in quarter three of 2024, ranking as the second most prominent malware.
LandUpdate808 redirects website visitors to download the loader for the fake update content first. The redirect also adds a cookie to the targeted user, which has been observed under the names “isDone” or “isVisited11”. The cookie’s value is set to true after the operation is successful. The cookie has a 4-day expiration and will cause the malware to skip the previous steps if it is detected. The fake update page is disguised as an out-of-date Chrome notification with a blue download button labeled “Update Chrome”. When clicked, the button will link to an “update.php” file. The payload has been observed as a JS, EXE, or MSIX file that frequently changes file type. Recent reporting has identified multiple domains tied to the same IP address, a potential indicator that the LandUpdate808 operation is expanding.
We recommend monitoring your network for the following indicators of compromise to determine whether users have been compromised by LandUpdate808 and related payloads.
| Type | Indicator |
|---|---|
| Domains – Malicious Payloads |
netzwerkreklame[.]de |
| Domains – Malicious Payloads |
digimind[.]nl |
| Domains – Malicious Payloads |
monlamdesigns[.]com |
| Domains – Malicious Payloads | sustaincharlotte[.]org |
| Domains – Malicious Payloads | chicklitplus[.]com |
| Domains – Malicious Payloads | espumadesign[.]com |
| Domains – Malicious Payloads | owloween[.]com |
| Domains – Malicious Payloads | Wildwoodpress[.]org |
| Domains – Malicious Payloads | napcis[.]org |
| Domains – Malicious Payloads | sunkissedindecember[.]com |
| Domains – Malicious Payloads | rm-arquisign[.]com |
| Domains – Fake Update Page Code | kongtuke[.]com |
| Domains – Fake Update Page Code | uhsee[.]com |
| Domains – Fake Update Page Code | zoomzle[.]com |
| Domains – Fake Update Page Code | elamoto[.]com |
| Domains – Fake Update Page Code | ashleypuerner[.]com |
| Domains – Fake Update Page Code | edveha[.]com |
| Domains – Initiated Requests for Content | razzball[.]com |
| Domains – Initiated Requests for Content | monitor[.]icef[.]com |
| Domains – Initiated Requests for Content | careers-advice-online[.]com |
| Domains – Initiated Requests for Content | ecowas[.]int |
| Domains – Initiated Requests for Content | sixpoint[.]com |
| Domains – Initiated Requests for Content | eco-bio-systems[.]de |
| Domains – Initiated Requests for Content | evolverangesolutions[.]com |
| Domains – Initiated Requests for Content | natlife[.]de |
| Domains – Initiated Requests for Content | sunkissedindecember[.]com |
| Domains – Initiated Requests for Content | fajardo[.]inter[.]edu |
| Domains – Initiated Requests for Content | fup[.]edu[.]co |
| Domains – Initiated Requests for Content | lauren-nelson[.]com |
| Domains – Initiated Requests for Content | netzwerkreklame[.]de |
| Domains – Initiated Requests for Content | digimind[.]nl |
| Domains – Initiated Requests for Content | itslife[.]in |
| Domains – Initiated Requests for Content | ecohortum[.]com |
| Domains – Initiated Requests for Content | thecreativemom[.]com |
| Domains – Initiated Requests for Content | backalleybikerepair[.]com |
| Domains – Initiated Requests for Content | mocanyc[.]org |
Samala, A. (2024b, October 15). New Behavior for LandUpdate808 Observed. Malasada Tech. https://malasada.tech/new-behavior-for-landupdate808-observed/
Samala, A. (2024a, July 2). The LandUpdate808 Fake Update Variant. Malasada Tech. https://malasada.tech/the-landupdate808-fake-update-variant/
Contributing Security Analyst: Benjamin Price