Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Summary
Unknown threat actors have compromised TeamUpdraft's website, potentially accessing customer connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. These compromised keys are reportedly being used to inject backdoors into WordPress websites, affecting users of the popular UpdraftPlus backup plugin.
IFF Assessment
The compromise of customer keys and the subsequent injection of backdoors into WordPress sites represent a direct threat to website security and data integrity.
Defender Context
This incident highlights the critical importance of securing vendor websites and customer credentials, as compromises can lead to cascading supply chain attacks. Defenders should monitor for unauthorized changes on their WordPress sites and review access controls for any third-party management tools.