A Newly Discovered WordPress Malware Variant Employs a Concealed Plugin and Blockchain Command Channel
A newly uncovered strain of malware targeting WordPress exploits a hidden plugin, illicitly gains administrative access, and employs a blockchain-based command channel to maintain its presence on compromised websites.
This sophisticated threat is designed to persist through typical cleanup attempts while silently harvesting sensitive information from affected servers.
The malware manifests as a must-use plugin, a specific category of WordPress component that loads automatically with each request and remains invisible on the standard Plugins page.
This strategic placement affords attackers a persistent foothold, rendering the malicious code less detectable to site owners during standard audits.
During a site cleanup in mid-June, cybersecurity experts at Wordfence identified the malware, which masqueraded as an innocuous health-check and reporting tool.
The malicious components appear under an array of more than 4,000 different filenames, frequently utilizing familiar appellations such as advanced-cache.php, db.php, and a theme’s functions.php.
The infection not only creates or commandeers administrator accounts but also captures passwords during login attempts and searches for sensitive payment-data-related secrets.
Moreover, the operatives behind this malware can leverage the implant to inject code into browsers, obliterate other plugins, alter plugin content, and propagate to other accessible WordPress installations within the same hosting environment.
This aspect renders a singular compromised site a perilous vulnerability for every site sharing its server resources.
Wordfence detailed in a report shared with Cyber Security News (CSN) that the malware exemplifies a blend of stealth, persistence, and a durable command-and-control design aimed at circumventing conventional detection and remediation measures.
The findings underscore the necessity for administrators to scrutinize aberrant account activities post-incident, particularly after breaches that exploit vulnerabilities in WordPress to steal credentials and deploy server-side backdoors.
WordPress Malware Conceals Itself with a Hidden Plugin
The malware stealthily resides within the wp-content/mu-plugins directory, a location where must-use plugins are inherently loaded by WordPress.
Unlike traditional plugins, these cannot be deactivated via the regular dashboard, offering attackers an immediate advantage once they attain write access to a site.
Additionally, it actively erases itself from WordPress dashboard displays. The malicious code obscures the plugin from the Must-Use Plugins screen, the regular Plugins page, update notifications, and the Site Health section.
This deliberate camouflage ensures that an administrator may perceive no overt signals, even as the malign plugin executes on each page request. The malware further complicates detection by employing a custom string-substitution methodology.
By eschewing widely recognized obfuscation techniques, which security teams often quickly identify, it conceals WordPress hook names, option names, file paths, and SQL statements until execution time.
Persistence is meticulously layered across multiple functions. The implant can forge a new administrator account, using prefixes such as admin_, adm_, administrator_, or backup_, succeeded by six random alphanumeric characters.
It can also reset an existing account’s password, conceal rogue accounts from dashboard and REST API user listings, and modify displayed user totals to minimize the likelihood of detection.
A self-repair mechanism is integrated, restoring the malware file if deleted or if its size diminishes. It retains a backup within the WordPress database, rewrites the file, backdates its modification timestamp, and alters permissions to read-only.
Additionally, it can reactivate itself and replicate to other WordPress installations located in common web server directories. Administrators combing through compromised sites must not rely solely on the Plugins screen.
Instead, they should inspect the must-use plugin directory, perform direct audits of the WordPress user database for unauthorized accounts, review options tables, rotate credentials, and check for other sites hosted on the same server.
Maintaining updated versions of WordPress and its plugins is vital, particularly in light of recently reported vulnerabilities in critical plugins that could offer attackers initial exploitation pathways into a site.
Blockchain Command-and-Control Mechanism Safeguards Operations
The malware employs a command-and-control system leveraging EtherHiding, a method that conceals command server details within smart contracts on the Ethereum blockchain.
Instead of embedding a static malicious domain or IP address, the implant queries blockchain data at runtime to retrieve current server addresses.
It draws from a selection of three predefined smart contract addresses and 21 public Remote Procedure Call gateways.
By executing an eth_call request, the malware recovers encrypted data, which includes decrypted credentials and a list of HTTP servers under the attacker’s control.
This arrangement prevents security professionals from merely blocking a single domain or reporting one hosting provider to dismantle operations.
Once established, the implant dispatches an encrypted report with site details, administrator information, active plugins, payment configurations, API keys, and directory paths to significant files.
It meticulously seeks out credentials housed in WordPress configuration files, environment files, and Git repositories associated with payment services and cloud infrastructures.
The remote server can then relay directives to replace the malware, eliminate security-centric plugins, strip selected content from plugin files, or inject JavaScript into visitor browsers through the WordPress footer.
This versatile framework allows the same infection to enable credential theft, payment skimming, spam distribution, redirects, or online server compromises.
This trend illustrates the increasing adoption of blockchain infrastructure for operational purposes in malicious activities.
A recent report detailing the use of blockchain to hide malware servers similarly described how attackers used EtherHiding to obfuscate their control systems.
Site proprietors should promptly investigate any unfamiliar must-use plugins, conduct audits of administrator accounts straight from the database rather than solely through the dashboard, examine unexpected WordPress configuration options, and review server logs for any suspicious outbound actions.
Furthermore, they should apply any available WordPress security updates, as recent guidance has highlighted the critical importance of timely patch implementations and thorough examinations of any unexpected files, plugins, and account modifications.
Indicators of Compromise (IoCs):
| Type | Indicator | Description |
|---|---|---|
| File path | wp-content/mu-plugins | Directory where the malware is implemented as a concealed must-use plugin. |
| File names | advanced-cache.php, db.php, functions.php | Common legitimate-sounding filenames associated with malware samples. |
| Account pattern | admin_xxxxxx | Potential rogue administrator username formation, coupled with six random trailing characters. |
| Account pattern | adm_xxxxxx | Potential rogue administrator username formation, coupled with six random trailing characters. |
| Account pattern | administrator_xxxxxx | Potential rogue administrator username formation, coupled with six random trailing characters. |
| Account pattern | backup_xxxxxx | Potential rogue administrator username formation, coupled with six random trailing characters. |
| WordPress option | src | Retains a backup copy of the malware’s PHP source code. |
| WordPress option | bu | Stores the username of the administrator created or adopted by the malware. |
| WordPress option | bp | Maintains the administrator password utilized by the malware. |
| WordPress option | ic | Archives usernames and plaintext passwords captured during administrator login attempts. |
| Cron schedule | jf_7xc5bj9trbgji | An instance of an unfamiliar custom WordPress cron schedule linked with the malware. |
| Ethereum function selector | 0x3bc5de30 | Smart contract method selector used to acquire encrypted command-channel data. |
Source link: Cybersecuritynews.com.
