we ran into a weird issue, where multiple links (buttons) on our site would lead to a gambling site (while masking themselves as our website. The URL was correct).

After a couple of hours I managed to clear out all malicious code and found a VERY interesting file.

So apparently we got hacked by a group called „chinafans“. They were even so kind to leave links to their telegram behind.

So yeah.. Not sure if it’s good that i post this? But felt like sharing an interesting discovery.