A recent cyberattack campaign, identified as StopAndProtect, has compromised thousands of WordPress websites, repurposing them into a vast command-and-control (C2) network. This operation combines ransomware tactics with covert data exfiltration, targeting sensitive corporate information globally.
The attackers employ deceptive fake CAPTCHA prompts on vulnerable WordPress sites. Unsuspecting visitors are tricked into executing malicious PowerShell commands, initiating a multi-stage infection process. This sequence deploys various malicious tools, including ransomware, credential stealers, and network worms.
Internal logs from the attackers reveal over 6,000 unique victim IP addresses, with significant concentrations in the United States, Russia, and India. The adversaries manage approximately 2,000 compromised WordPress domains, ensuring a resilient infrastructure for payload distribution and data exfiltration.
Notably, some compromised WordPress staging servers exposed PHP endpoints and open directories, allowing researchers to access internal activity logs and source code. In one instance, an operator inadvertently uploaded internal development files, including a custom tool for managing hijacked WordPress domains and deploying new payloads.
This campaign underscores the critical importance of maintaining up-to-date Content Management Systems. Unpatched WordPress sites, some lacking updates since 2021, present numerous vulnerabilities that attackers exploit to establish persistent backdoors.
Website administrators must enforce regular updates for WordPress core files, themes, and plugins. Additionally, routine scans for unauthorized scripts, modified configuration files, and suspicious administrator accounts are essential. Users should exercise caution with websites prompting terminal command execution, and security teams should monitor for unauthorized PowerShell activity and unusual data transfers.
The StopAndProtect operation highlights the evolving threat landscape, where compromised websites serve as sophisticated C2 servers, blending malicious activities with legitimate web traffic. Proactive security measures are imperative to mitigate such risks.
