Malicious plugins for WordPress websites are being used not just to maintain access on the compromised server but also to mine for cryptocurrency.
The components are clones of legitimate software, altered for malicious purposes like content encryption and acquisition of a ransom payment. WordPress Framework is the plugin currently being impersonated and exploited to install ransomware on WordPress sites. It helps attackers gain and maintain unauthorized access to the site environment. The development of the legitimate plugin seems to have stopped in 2011. Despite this, it still has more than 400 active installations.
Apart from scanning for functions that allow command execution at the server level and restricting this privilege to the botmaster, the plugin also carried code to run a Linux binary that mines for cryptocurrency.
Instead of creating a malicious WordPress plugin from scratch, attackers can modify the code of an existing one to include malicious components.