As recently as Wednesday afternoon, a U.S. government website was hosting a malicious JavaScript downloader that led victims to installations of Cerber ransomware.
Researcher Ankit Anubhav of NewSky Security tweeted the discovery Wednesday, and within hours, the malware link was taken down. It’s unknown whether anyone was infected through the site.
It’s also unknown how the downloader was dropped onto the .gov site. Anubhav speculated that either the site was hacked, or it possibly stores attachments from government officials’ emails and the downloader was archived.