December 3, 2023
Severity High Analysis Summary A new and sophisticated Android malware, named FjordPhantom, has been disclosed by cybersecurity researchers. The malware targets users in Southeast Asian countries, […]
Rewterz Threat Alert – Turla group Exploits Their CounterParts
October 21, 2019Rewterz Threat Alert – Credential Phish From Scam URL
October 22, 2019Rewterz Threat Alert – Turla group Exploits Their CounterParts
October 21, 2019Rewterz Threat Alert – Credential Phish From Scam URL
October 22, 2019
Severity
High
Analysis Summary
Malicious plugins for WordPress websites are being used not just to maintain access on the compromised server but also to mine for cryptocurrency.
The components are clones of legitimate software, altered for malicious purposes like content encryption and acquisition of a ransom payment. WordPress Framework is the plugin currently being impersonated and exploited to install ransomware on WordPress sites. It helps attackers gain and maintain unauthorized access to the site environment. The development of the legitimate plugin seems to have stopped in 2011. Despite this, it still has more than 400 active installations.
Apart from scanning for functions that allow command execution at the server level and restricting this privilege to the botmaster, the plugin also carried code to run a Linux binary that mines for cryptocurrency.
Instead of creating a malicious WordPress plugin from scratch, attackers can modify the code of an existing one to include malicious components.
Impact
- Command Execution
- Content Encryption
Indicators of Compromise
MD5
3a88d0ac48cd61d4d7b07a7b7504e822
SHA256
6e1e0517e8d86845b970592ec72a28eea2c5817c5810133290233f0917fec5f8
SHA1
bea781acfe2b6eb9685199d2c295c2573047dfec
Remediation
- Block the threat indicators at their respective controls.
- Do not install unnecessary plugins.
- Check the additional site components when doing a malware cleanup since many times this procedure is limited to WordPress core files. Themes and plugins are often migrated without any prior scrutiny.
- Keep a backup of all website content.