Stolen UpdraftCentral keys used to backdoor WordPress sites
Summary
A threat actor gained access to TeamUpdraft's website, compromising connection keys for their UpdraftCentral product. These compromised keys could allow attackers to remotely execute commands on connected WordPress sites, effectively backdooring them.
IFF Assessment
FOE
The compromise of connection keys allows attackers to gain unauthorized control over user websites, posing a direct threat to defenders.
Defender Context
This incident highlights the risk of supply chain attacks targeting popular plugins and services. Defenders should be vigilant about compromised third-party software and consider implementing stricter access controls and monitoring for unusual activity from plugins. Regularly reviewing connected services and their security posture is crucial.