www.trendmicro.com Open in urlscan Pro
23.79.152.254  Public Scan

Form analysis
3 forms found in the DOM

<form class="main-menu-search" aria-label="Search Trend Micro">
  <div class="main-menu-search__field-wrapper" id="cludo-search-form">
    <table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
      <tbody>
        <tr>
          <td class="gsc-input">
            <input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
          </td>
        </tr>
      </tbody>
    </table>
  </div>
</form>

<form class="main-menu-search" aria-label="Search Trend Micro">
  <div class="main-menu-search__field-wrapper" id="cludo-search-form-mobile">
    <table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
      <tbody>
        <tr>
          <td class="gsc-input">
            <input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
          </td>
          <td class="gsc-search-close collapsed" style="width:1%;" data-target="#search-mobile-wrapper" data-toggle="collapse">
            <span class="icon-close"></span>
          </td>
        </tr>
      </tbody>
    </table>
  </div>
</form>

POST #

<form class="acsb-form" data-acsb-search="form" enctype="multipart/form-data" action="#" method="POST"> <input type="text" tabindex="0" name="acsb_search" autocomplete="off" placeholder="Unclear content? Search in dictionary..."
    aria-label="Unclear content? Search in dictionary..."> <i class="acsbi-search"></i> <i class="acsbi-chevron_down"></i> </form>

Text Content

Skip to Content
↵ENTER
Skip to Menu
↵ENTER
Skip to Footer
↵ENTER
dismiss
5 Alerts

 * Essential IoT security: Protect yourself now
   
   dismiss
   Learn more

 * Customized Ransomware: Bolster Your Defenses
   
   dismiss
   Learn more

 * Webinar: Cybercrime Essentials
   
   dismiss
   Save your spot

 * 4 Cybersecurity Budget Management Tips
   
   dismiss
   Learn more

 * Midyear Cybersecurity Report: Defending the Expanding Attack Surface
   
   dismiss
   Learn why

 * No new notifications at this time.

Download
 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

Buy
 * Find a Partner
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

Region
 * The Americas
 * United States
 * Brasil
 * Canada
 * México
 * Middle East & Africa
 * South Africa
 * Middle East and North Africa

 * Europe
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Nederland

 * Norge (Norway)
 * Polska (Poland)
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

 * Asia & Pacific
 * Australia
 * Центральная Азия (Central Asia)
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)
 * Malaysia
 * Монголия (Mongolia) and рузия (Georgia)
 * New Zealand

 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

Log In
 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

Free trials
 * Cloud
 * Detection and Response
 * User Protection

Folio (0)
Contact Us
 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)


Business 
For Home 

Products Products
Trend Micro One - our unified cybersecurity platform >

Hybrid Cloud Security
Workload Security
Conformity
Container Security
File Storage Security
Application Security
Network Security
Open Source Security
Network Security
Intrusion Prevention
Advanced Threat Protection
Industrial Network Security
Mobile Network Security
Zero Trust Secure Access
User Protection
Endpoint Security
Email Security
Mobile Security
Web Security
Industrial Endpoint
Detection & Response
XDR
Risk Insights
Powered by
AI/Machine Learning
Global Threat Intelligence
All Products & Trials

Our Unified Platform

Service Packages

Small & Midsize Business Security

Solutions Solutions
For Cloud
Cloud Migration
Cloud-Native App Development
Cloud Operational Excellence
Data Center Security
SaaS Applications
Internet of Things (IoT)
ICS / OT
Connected Car
5G Security for Enterprises
Risk Management
Ransomware
Cyber Insurance
End-of-Support Systems
Compliance
Detection and Response
Industries
Healthcare
Manufacturing
Oil & Gas
Electric Utility
Federal
Why Trend Micro Why Trend Micro
The Trend Micro Difference
Customer Successes
The Human Connection
Strategic Alliances

Industry Leadership
Research Research
Research
About Our Research
Research and Analysis
Research, News and Perspectives
Security Reports
Security News
Zero Day Initiative (ZDI)
Blog
Research by Topic
Vulnerabilities
Annual Predictions
The Deep Web
Internet of Things (IoT)
Resources
DevOps Resource Center
CISO Resource Center
What Is?
Threat Encyclopedia
Cloud Health Assessment
Cyber Risk Assessment
Enterprise Guides
Glossary of Terms

EXPLORE THE CYBER RISK INDEX (CRI)

Use the CRI to assess your organization’s preparedness against attacks, and get
a snapshot of cyber risk across organizations globally.

Calculate your risk
Services & Support Services & Support
Services
Service Packages
Managed XDR
Support Services
Business Support
Log In to Support
Technical Support
Virus & Threat Help
Renewals & Registration
Education & Certification
Contact Support
Downloads
Free Cleanup Tools
Find a Support Partner
For Popular Products
Deep Security
Apex One
Worry-Free
Worry-Free Renewals
Partners Partners
Channel Partners
Channel Partner Overview
Managed Service Provider
Cloud Service Provider
Professional Services
Resellers
Marketplace
System Integrators
Alliance Partners
Alliance Overview
Technology Alliance Partners
Our Alliance Partners
Tools and Resources
Find a Partner
Education and Certification
Partner Successes
Distributors
Partner Login
Company Company
Overview
Leadership
Customer Success Stories
Human Connections
Strategic Alliances
Industry Accolades
Newsroom
Webinars
Events
Security Experts
Careers
History
Corporate Social Responsibility
Diversity, Equity & Inclusion
Trust Center
Internet Safety and Cybersecurity Education
Investors
Legal



×
Folio (0)
5 Alerts

 * Essential IoT security: Protect yourself now
   
   dismiss
   Learn more

 * Customized Ransomware: Bolster Your Defenses
   
   dismiss
   Learn more

 * Webinar: Cybercrime Essentials
   
   dismiss
   Save your spot

 * 4 Cybersecurity Budget Management Tips
   
   dismiss
   Learn more

 * Midyear Cybersecurity Report: Defending the Expanding Attack Surface
   
   dismiss
   Learn why

 * No new notifications at this time.

Download
 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

Buy
 * Find a Partner
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

Region
 * The Americas
 * United States
 * Brasil
 * Canada
 * México
 * Middle East & Africa
 * South Africa
 * Middle East and North Africa

 * Europe
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Nederland

 * Norge (Norway)
 * Polska (Poland)
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

 * Asia & Pacific
 * Australia
 * Центральная Азия (Central Asia)
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)
 * Malaysia
 * Монголия (Mongolia) and рузия (Georgia)
 * New Zealand

 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

Log In
 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

Free trials
 * Cloud
 * Detection and Response
 * User Protection

Folio (0)
Contact Us
 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)



 * Essential IoT security: Protect yourself now
   
   dismiss
   Learn more

 * Customized Ransomware: Bolster Your Defenses
   
   dismiss
   Learn more

 * Webinar: Cybercrime Essentials
   
   dismiss
   Save your spot

 * 4 Cybersecurity Budget Management Tips
   
   dismiss
   Learn more

 * Midyear Cybersecurity Report: Defending the Expanding Attack Surface
   
   dismiss
   Learn why
 * No new notifications at this time.

 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

 * Find a Partner
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

 * The Americas
 * United States
 * Brasil
 * Canada
 * México
 * Middle East & Africa
 * South Africa
 * Middle East and North Africa

 * Europe
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Nederland

 * Norge (Norway)
 * Polska (Poland)
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

 * Asia & Pacific
 * Australia
 * Центральная Азия (Central Asia)
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)
 * Malaysia
 * Монголия (Mongolia) and рузия (Georgia)
 * New Zealand

 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

 * Cloud
 * Detection and Response
 * User Protection

 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)

undefined



APT & Targeted Attacks
Operation Red Signature Targets South Korean Companies

Subscribe

Content added to Folio

Folio (0) close

APT & Targeted Attacks


OPERATION RED SIGNATURE TARGETS SOUTH KOREAN COMPANIES

We uncovered Operation Red Signature, an information theft-driven supply chain
attack targeting organizations in South Korea. We discovered the attacks around
the end of July, while the media reported the attack in South Korea on August 6.

By: Jaromir Horejsi, Joseph C Chen, Kawabata Kohei, Kenney Lu August 21, 2018
Read time: 4 min (1180 words)

Save to Folio

Subscribe

--------------------------------------------------------------------------------

Together with our colleagues at IssueMakersLab, we uncovered Operation Red
Signature, an information theft-driven supply chain attack targeting
organizations in South Korea. We discovered the attacks around the end of July,
while the media reported the attack in South Korea on August 6.

The threat actors compromised the update server of a remote support solutions
provider to deliver a remote access tool called 9002 RAT to their targets of
interest through the update process. They carried this out by first stealing the
company’s certificate then using it to sign the malware. They also configured
the update server to only deliver malicious files if the client is located in
the range of IP addresses of their target organizations.

9002 RAT also installed additional malicious tools: an exploit tool for Internet
Information Services (IIS) 6 WebDav (exploiting CVE-2017-7269) and an SQL
database password dumper. These tools hint at how the attackers are also after
data stored in their target’s web server and database.

Figure 1. Operation Red Signature’s attack chain

Here’s how Operation Red Signature works:

 1. The code-signing certificate from the remote support solutions provider is
    stolen. It’s possible that the certificate was stolen as early as April
    2018, as we found a ShiftDoor malware
    (4ae4aed210f2b4f75bdb855f6a5c11e625d56de2) on April 8 that was signed with
    the stolen certificate.
 2. Malicious update files are prepared, signed with the stolen certificate, and
    uploaded to the attacker’s server (207[.]148[.]94[.]157).
 3. The update server of the company is hacked.
 4. The update server is configured to receive an update.zip file from the
    attackers’ server if a client is connecting from a specific range of IP
    addresses belonging to their targeted organizations.
 5. The malicious update.zip file is sent to the client when the remote support
    program is executed.
 6. The remote support program recognizes the update files as normal and
    executes the 9002 RAT malware inside it.
 7. 9002 RAT downloads and executes additional malicious files from the
    attackers’ server.

Technical analysis

The update.zip file contains an update.ini file, which has the malicious update
configuration that specifies the remote support solution program to download
file000.zip and file001.zip and extract them as rcview40u.dll and rcview.log to
the installation folder.

The program will then execute rcview40u.dll, signed with the stolen certificate,
with Microsoft register server (regsvr32.exe). This dynamic-link library (DLL)
is responsible for decrypting the encrypted rcview.log file and executing it in
memory. 9002 RAT is the decrypted rcview.log payload, which connects to the
command-and-control (C&C) server at 66[.]42[.]37[.]101.



Figure 2. Contents of the malicious update configuration





Figure 3. How the compromised update process launches the 9002 RAT malware



Figure 4. Known 9002 RAT string pattern inside the decrypted payload of the
rcview.log file

Correlating 9002 RAT 

Delving into 9002 RAT, we found that it was compiled on July 17, 2018, and that
the configuration files inside update.zip were created on July 18. Our analysis
of an update log file we found reveals the remote support program’s update
process started around 13:35 on July 18, with the 9002 RAT being downloaded and
launched. We also saw the RAT file used for this specific attack was set to be
inactive in August, so we can construe that the RAT’s activity was rather
short-lived (from July 18 to July 31).







Figure 5. Compilation timestamp on 9002 RAT sample (top), timestamp of the
malicious configuration (center), and snapshot of the program’s update log
(bottom)



Figure 6. Code snippet showing 9002 RAT checking the system time and setting
itself to sleep in August 2018

Additional malware tools

The 9002 RAT also serves as a springboard for delivering additional malware.
Most of these are downloaded as files compressed with the Microsoft cabinet
format (.cab). This is most likely done to avoid detection by antivirus (AV)
solutions.

Here’s a list of files that 9002 RAT retrieves and delivers to the affected
system:

Filename Tool Purpose dsget.exe DsGet View active directory objects dsquery.exe
DsQuery Search for active directory objects sharphound.exe SharpHound Collect
active directory information aio.exe All In One (AIO) Publicly available hack
tool ssms.exe SQL Password dumper Dump password from SQL database printdat.dll
RAT (PlugX variant) Remote access tool w.exe IIS 6 WebDav Exploit Tool Exploit
tool for CVE-2017-7269 (IIS 6) Web.exe WebBrowserPassView Recover password
stored by browser smb.exe Scanner Scans the system’s Windows version and
computer name m.exe Custom Mimikatz (including 32bit / 64bit file) Verify
computer password and active directory credentials

Figure 7. Downloaded Web.ex_ cabinet file (left) and decompressed Web.exe file
(right)

One of the downloaded files printdat.dll, which is another RAT. It is a variant
of PlugX malware, and connects to the same C&C server (66[.]42[.]37[.]101).



Figure 8. Internal PlugX date dword value inside the printdat.dll file

Mitigating supply chain attacks

Supply chain attacks don’t just affect users and businesses — they exploit the
trust between vendors and its clients or customers. By trojanizing
software/applications or manipulating the infrastructures or platforms that run
them, supply chain attacks affects the integrity and security of the goods and
services that organizations provide. In healthcare, for instance, where the
industry heavily relies on third-party and cloud-based services, supply chain
attacks can risk the privacy of personally identifiable data and intellectual
property, disrupt hospital operations, and even endanger patient health. And
when stacked up with regulations such as the EU General Data Protection and
Regulation (GDPR), the impact can be exacerbated.

Here are some best practices:

 * Oversee third-party products and services; apart from ensuring the security
   of the organization’s own online premises (e.g., patching, authentication
   mechanisms), security controls must also be in place in third-party
   applications being used.
 * Develop a proactive incident response strategy: Supply chain attacks are
   often targeted; organizations must be able to fully understand, manage, and
   monitor the risks involved in third-party vendors.
 * Proactively monitor the network for anomalous activities; firewalls and
   intrusion detection and prevention systems help mitigate network-based
   threats.
 * Enforce the principle of least privilege: Network segmentation, data
   categorization, restriction of system administration tools, and application
   control help deter lateral movement and minimize data being exposed.

Trend Micro Solutions

The Trend Micro™ Deep Discovery™ solution provides detection, in-depth analysis,
and proactive response to today’s stealthy malware and targeted attacks in real
time. It provides a comprehensive defense tailored to protect organizations
against targeted attacks and advanced threats through specialized engines,
custom sandboxing, and seamless correlation across the entire attack life cycle,
allowing it to detect threats even without any engine or pattern update. Trend
Micro endpoint solutions such as the Smart Protection Suites and Worry-Free
Business Security solutions can protect users and businesses from threats by
detecting malicious files and blocking all related malicious URLs.

Indicators of Compromise (IoCs):

Related hashes (SHA-256):

 * 0703a917aaa0630ae1860fb5fb1f64f3cfb4ea8c57eac71c2b0a407b738c4e19 (ShiftDoor)
   — detected by Trend Micro as BKDR_SETHC.D
 * c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e (aio.exe) —
   HKTL_DELOG
 * a3a1b1cf29a8f38d05b4292524c3496cb28f78d995dfb0a9aef7b2f949ac278b (m.exe) —
   HKTL_MIMIKATZ
 * 9415ca80c51b2409a88e26a9eb3464db636c2e27f9c61e247d15254e6fbb31eb
   (printdat.dll) — TSPY_KORPLUG.AN
 * 52374f68d1e43f1ca6cd04e5816999ba45c4e42eb0641874be25808c9fe15005 (rcview.log)
   — TROJ_SIDELOADR.ENC
 * bcfacc1ad5686aee3a9d8940e46d32af62f8e1cd1631653795778736b67b6d6e
   (rcview40u.dll) — TROJ_SIDELOADR.A
 * 279cf1773903b7a5de63897d55268aa967a87f915a07924c574e42c9ed12de30
   (sharphound.exe) — HKTL_BLOODHOUND
 * e5029808f78ec4a079e889e5823ee298edab34013e50a47c279b6dc4d57b1ffc (ssms.exe)
   — HKTL_PASSDUMP
 * e530e16d5756cdc2862b4c9411ac3bb3b113bc87344139b4bfa2c35cd816e518 (w.exe)
   — TROJ_CVE20177269.MOX
 * 28c5a6aefcc57e2862ea16f5f2ecb1e7df84b68e98e5814533262595b237917d (Web.exe)
   — HKTL_BROWSERPASSVIEW.GA

URLs related to the malicious update file:

 * hxxp://207[.]148[.]94[.]157/update/rcv50/update.zip
 * hxxp://207[.]148[.]94[.]157/update/rcv50/file000.zip
 * hxxp://207[.]148[.]94[.]157/update/rcv50/file001.zip

URLs related to additionally downloaded malicious files:

 * hxxp://207[.]148[.]94[.]157/aio.exe
 * hxxp://207[.]148[.]94[.]157/smb.exe
 * hxxp://207[.]148[.]94[.]157/m.ex_
 * hxxp://207[.]148[.]94[.]157/w
 * hxxp://207[.]148[.]94[.]157/Web.ex_

Related C&C server (9002 RAT and PlugX variant):

 * 66[.]42[.]37[.]101


Tags
Network | APT & Targeted Attacks | Research


AUTHORS

 * Jaromir Horejsi
   
   Threat Researcher

 * Joseph C Chen
   
   Threat Researcher

 * Kawabata Kohei
   
   Sr. Security Specialist

 * Kenney Lu
   
   Threat Researcher

Contact Us
Subscribe


RELATED ARTICLES

 * Security Risks in Logistics APIs Used by E-Commerce Platforms
 * Examining the Black Basta Ransomware’s Infection Routine
 * Examining New DawDropper Banking Dropper and DaaS on the Dark Web

See all articles



RECOMMENDED FOR YOU

malware


BUMBLEBEE A NEW MODULAR BACKDOOR EVOLVED FROM BOOKWORM


LEARN MORE




 * Contact Sales
 * Locations
 * Careers
 * Newsroom
 * Trust Center
 * Privacy
 * Accessibility
 * Support
 * Site map

 * linkedin
 * twitter
 * facebook
 * youtube
 * instagram
 * rss

Copyright © 2022 Trend Micro Incorporated. All rights reserved.

sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk

This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more

Cookies Settings Accept





English
Accessibility Adjustments
Reset Settings Statement Hide Interface

Choose the right accessibility profile for you
OFF ON
Seizure Safe Profile Clear flashes & reduces color
This profile enables epileptic and seizure prone users to browse safely by
eliminating the risk of seizures that result from flashing or blinking
animations and risky color combinations.
OFF ON
Vision Impaired Profile Enhances website's visuals
This profile adjusts the website, so that it is accessible to the majority of
visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract,
Glaucoma, and others.
OFF ON
ADHD Friendly Profile More focus & fewer distractions
This profile significantly reduces distractions, to help people with ADHD and
Neurodevelopmental disorders browse, read, and focus on the essential elements
of the website more easily.
OFF ON
Cognitive Disability Profile Assists with reading & focusing
This profile provides various assistive features to help users with cognitive
disabilities such as Autism, Dyslexia, CVA, and others, to focus on the
essential elements of the website more easily.
OFF ON
Keyboard Navigation (Motor) Use website with the keyboard
This profile enables motor-impaired persons to operate the website using the
keyboard Tab, Shift+Tab, and the Enter keys. Users can also use shortcuts such
as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics)
to jump to specific elements.

Note: This profile prompts automatically for keyboard users.
OFF ON
Blind Users (Screen Reader) Optimize website for screen-readers
This profile adjusts the website to be compatible with screen-readers such as
JAWS, NVDA, VoiceOver, and TalkBack. A screen-reader is software that is
installed on the blind user’s computer and smartphone, and websites should
ensure compatibility with it.

Note: This profile prompts automatically to screen-readers.
Content Adjustments
Content Scaling
Default

Readable Font
Highlight Titles
Highlight Links
Text Magnifier
Adjust Font Sizing
Default

Align Center
Adjust Line Height
Default

Align Left
Adjust Letter Spacing
Default

Align Right
Color Adjustments
Dark Contrast
Light Contrast
High Contrast
High Saturation
Adjust Text Colors
Cancel
Monochrome
Adjust Title Colors
Cancel
Low Saturation
Adjust Background Colors
Cancel
Orientation Adjustments
Mute Sounds
Hide Images
Read Mode
Reading Guide
Useful Links
Select an option Home Header Footer Main Content
Stop Animations
Reading Mask
Highlight Hover
Highlight Focus
Big Black Cursor
Big White Cursor
HIDDEN_ADJUSTMENTS
Keyboard Navigation
Accessible Mode
Screen Reader Adjustments
Read Mode
Web Accessibility Solution By accessiBe
Choose the Interface Language
English
Español
Deutsch
Português
Français
Italiano
עברית
繁體中文
Pусский
عربى
عربى
Nederlands
繁體中文
日本語
Polski
Türk
Accessibility StatementCompliance status

We firmly believe that the internet should be available and accessible to anyone
and are committed to providing a website that is accessible to the broadest
possible audience, regardless of ability.

To fulfill this, we aim to adhere as strictly as possible to the World Wide Web
Consortium’s (W3C) Web Content Accessibility Guidelines 2.1 (WCAG 2.1) at the AA
level. These guidelines explain how to make web content accessible to people
with a wide array of disabilities. Complying with those guidelines helps us
ensure that the website is accessible to blind people, people with motor
impairments, visual impairment, cognitive disabilities, and more.

This website utilizes various technologies that are meant to make it as
accessible as possible at all times. We utilize an accessibility interface that
allows persons with specific disabilities to adjust the website’s UI (user
interface) and design it to their personal needs.

Additionally, the website utilizes an AI-based application that runs in the
background and optimizes its accessibility level constantly. This application
remediates the website’s HTML, adapts its functionality and behavior for
screen-readers used by blind users, and for keyboard functions used by
individuals with motor impairments.

If you wish to contact the website’s owner please use the website's form

Screen-reader and keyboard navigation

Our website implements the ARIA attributes (Accessible Rich Internet
Applications) technique, alongside various behavioral changes, to ensure blind
users visiting with screen-readers can read, comprehend, and enjoy the website’s
functions. As soon as a user with a screen-reader enters your site, they
immediately receive a prompt to enter the Screen-Reader Profile so they can
browse and operate your site effectively. Here’s how our website covers some of
the most important screen-reader requirements:

 1. Screen-reader optimization: we run a process that learns the website’s
    components from top to bottom, to ensure ongoing compliance even when
    updating the website. In this process, we provide screen-readers with
    meaningful data using the ARIA set of attributes. For example, we provide
    accurate form labels; descriptions for actionable icons (social media icons,
    search icons, cart icons, etc.); validation guidance for form inputs;
    element roles such as buttons, menus, modal dialogues (popups), and others. 
    
    Additionally, the background process scans all of the website’s images. It
    provides an accurate and meaningful image-object-recognition-based
    description as an ALT (alternate text) tag for images that are not
    described. It will also extract texts embedded within the image using an OCR
    (optical character recognition) technology. To turn on screen-reader
    adjustments at any time, users need only to press the Alt+1 keyboard
    combination. Screen-reader users also get automatic announcements to turn
    the Screen-reader mode on as soon as they enter the website.
    
    These adjustments are compatible with popular screen readers such as JAWS,
    NVDA, VoiceOver, and TalkBack.
    
    
 2. Keyboard navigation optimization: The background process also adjusts the
    website’s HTML and adds various behaviors using JavaScript code to make the
    website operable by the keyboard. This includes the ability to navigate the
    website using the Tab and Shift+Tab keys, operate dropdowns with the arrow
    keys, close them with Esc, trigger buttons and links using the Enter key,
    navigate between radio and checkbox elements using the arrow keys, and fill
    them in with the Spacebar or Enter key.
    
    Additionally, keyboard users will find content-skip menus available at any
    time by clicking Alt+2, or as the first element of the site while navigating
    with the keyboard. The background process also handles triggered popups by
    moving the keyboard focus towards them as soon as they appear, not allowing
    the focus to drift outside.
    
    Users can also use shortcuts such as “M” (menus), “H” (headings), “F”
    (forms), “B” (buttons), and “G” (graphics) to jump to specific elements.

Disability profiles supported on our website
 * Epilepsy Safe Profile: this profile enables people with epilepsy to safely
   use the website by eliminating the risk of seizures resulting from flashing
   or blinking animations and risky color combinations.
 * Vision Impaired Profile: this profile adjusts the website so that it is
   accessible to the majority of visual impairments such as Degrading Eyesight,
   Tunnel Vision, Cataract, Glaucoma, and others.
 * Cognitive Disability Profile: this profile provides various assistive
   features to help users with cognitive disabilities such as Autism, Dyslexia,
   CVA, and others, to focus on the essential elements more easily.
 * ADHD Friendly Profile: this profile significantly reduces distractions and
   noise to help people with ADHD, and Neurodevelopmental disorders browse,
   read, and focus on the essential elements more easily.
 * Blind Users Profile (Screen-readers): this profile adjusts the website to be
   compatible with screen-readers such as JAWS, NVDA, VoiceOver, and TalkBack. A
   screen-reader is installed on the blind user’s computer, and this site is
   compatible with it.
 * Keyboard Navigation Profile (Motor-Impaired): this profile enables
   motor-impaired persons to operate the website using the keyboard Tab,
   Shift+Tab, and the Enter keys. Users can also use shortcuts such as “M”
   (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to
   jump to specific elements.

Additional UI, design, and readability adjustments
 1. Font adjustments – users can increase and decrease its size, change its
    family (type), adjust the spacing, alignment, line height, and more.
 2. Color adjustments – users can select various color contrast profiles such as
    light, dark, inverted, and monochrome. Additionally, users can swap color
    schemes of titles, texts, and backgrounds with over seven different coloring
    options.
 3. Animations – epileptic users can stop all running animations with the click
    of a button. Animations controlled by the interface include videos, GIFs,
    and CSS flashing transitions.
 4. Content highlighting – users can choose to emphasize essential elements such
    as links and titles. They can also choose to highlight focused or hovered
    elements only.
 5. Audio muting – users with hearing devices may experience headaches or other
    issues due to automatic audio playing. This option lets users mute the
    entire website instantly.
 6. Cognitive disorders – we utilize a search engine linked to Wikipedia and
    Wiktionary, allowing people with cognitive disorders to decipher meanings of
    phrases, initials, slang, and others.
 7. Additional functions – we allow users to change cursor color and size, use a
    printing mode, enable a virtual keyboard, and many other functions.

Assistive technology and browser compatibility

We aim to support as many browsers and assistive technologies as possible, so
our users can choose the best fitting tools for them, with as few limitations as
possible. Therefore, we have worked very hard to be able to support all major
systems that comprise over 95% of the user market share, including Google
Chrome, Mozilla Firefox, Apple Safari, Opera and Microsoft Edge, JAWS, and NVDA
(screen readers), both for Windows and MAC users.

Notes, comments, and feedback

Despite our very best efforts to allow anybody to adjust the website to their
needs, there may still be pages or sections that are not fully accessible, are
in the process of becoming accessible, or are lacking an adequate technological
solution to make them accessible. Still, we are continually improving our
accessibility, adding, updating, improving its options and features, and
developing and adopting new technologies. All this is meant to reach the optimal
level of accessibility following technological advancements. If you wish to
contact the website’s owner, please use the website's form

Hide Accessibility Interface? Please note: If you choose to hide the
accessibility interface, you won't be able to see it anymore, unless you clear
your browsing history and data. Are you sure that you wish to hide the
interface?
Accept Cancel

Continue



Processing the data, please give it a few seconds...


AddThis Sharing Sidebar
Share to FacebookFacebookShare to TwitterTwitterShare to PrintPrintMore AddThis
Share optionsAddThis
5
SHARES
Hide
Show
Close
AddThis