#threatreport #LowCompleteness
Over 5,000 WordPress sites caught in WP3[.]XYZ malware attack | 23-01-2025
Source:Key details below ↓

🤖LLM extracted TTPs:`
T1059, T1190, T1078

🧨IOCs:
 - Domain: 1
 - Url: 5
 - File: 14

💽Software: WordPress

🔠Functions: createUser, DOMParser, installPlugin

📜Programming Languages: php

#threatreport:
A widespread malware campaign targeting WordPress websites has been discovered, impacting more than 5,000 sites globally. The malicious domain,was identified by a crawler developed by c/side. This campaign involves the downloading and activation of a malicious WordPress plugin, resulting in the transmission of sensitive data to a remote server. The attackers gain admin access to the targeted website, allowing them to upload the malicious plugin from a remote server. The process involves fetching the plugin, obtaining the CSRF token, downloading the malicious plugin file, and submitting it for installation through the plugin upload page at /wp-admin/update.php?action=upload-plugin.

Website owners are urged to review all admin accounts, ensure proper password and 2FA configurations, and utilize public crawlers to identify potential malicious scripts present on their websites. By taking proactive security measures and staying vigilant against emerging threats like this malware campaign, organizations can reduce the risk of compromise and safeguard their digital assets.