Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
Summary
A cybercrime crew inadvertently exposed one of its servers for three weeks, revealing its tools, activity logs, and target lists of over 1.4 million websites. The exposed data provided researchers with an inside look at how a mass site-hacking operation functions, specifically detailing the WP-SHELLSTORM backdoor used to compromise WordPress sites.
IFF Assessment
The article details a successful hacking operation that compromised a large number of websites, representing a significant threat to defenders.
Defender Context
This incident highlights the importance of diligent server security and monitoring for exposed credentials or misconfigurations that could be exploited by attackers. Defenders should be aware of common backdoors like WP-SHELLSTORM and ensure their WordPress sites are patched and secured against such widespread compromise campaigns.