Unsecured Hacker Server Exposes Mass WordPress Site Compromise Campaign

A team of security researchers has discovered an unsecured server belonging to a cybercriminal group. The server remained open on the internet for three weeks, which made it possible to access the operation's internal materials.

Among the data uncovered were a hacking toolkit, logs of the attackers' activity, and target lists comprising more than 1.4 million sites. That said, according to the researchers, only a portion of them were actually compromised.

What the leaked files revealed

The materials that were discovered allowed the researchers to study in detail how a mass site compromise operation is organized from the inside — from the tools used to the mechanics of selecting and processing targets. The operation in question is now being tracked by specialists under a separate name tied to the WP-SHELLSTORM backdoor, which was used to maintain persistence on the compromised WordPress-based resources.

The case demonstrates that even the operators of large-scale malicious campaigns make their own mistakes in securing their infrastructure, which ultimately allows security researchers to gain a rare glimpse into the inner workings of such operations.

Details about the specific methods used to compromise the sites, as well as the scale of the real damage to WordPress site owners, remain the subject of further investigation for now.

Source: The Hacker News