• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Turla group Exploits Their CounterParts
October 21, 2019
Rewterz Threat Alert – Credential Phish From Scam URL
October 22, 2019

Rewterz Threat Alert – Fake WordPress Plugin Embedded with Cryptocurrency Miner

October 21, 2019

Severity

High

Analysis Summary

Malicious plugins for WordPress websites are being used not just to maintain access on the compromised server but also to mine for cryptocurrency. 
The components are clones of legitimate software, altered for malicious purposes like content encryption and acquisition of a ransom payment. WordPress Framework is the plugin currently being impersonated and exploited to install ransomware on WordPress sites. It helps attackers gain and maintain unauthorized access to the site environment. The development of the legitimate plugin seems to have stopped in 2011. Despite this, it still has more than 400 active installations.

Apart from scanning for functions that allow command execution at the server level and restricting this privilege to the botmaster, the plugin also carried code to run a Linux binary that mines for cryptocurrency.

Instead of creating a malicious WordPress plugin from scratch, attackers can modify the code of an existing one to include malicious components.

Impact

  • Command Execution
  • Content Encryption

Indicators of Compromise

MD5

3a88d0ac48cd61d4d7b07a7b7504e822

SHA256

6e1e0517e8d86845b970592ec72a28eea2c5817c5810133290233f0917fec5f8

SHA1

bea781acfe2b6eb9685199d2c295c2573047dfec

Remediation

  • Block the threat indicators at their respective controls.
  • Do not install unnecessary plugins.
  • Check the additional site components when doing a malware cleanup since many times this procedure is limited to WordPress core files. Themes and plugins are often migrated without any prior scrutiny.
  • Keep a backup of all website content.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.