English
Magyar
The Dr. Web team has discovered a website hacking tool called Linux.BackDoor.WordPressExploit.1, which targets websites based on the WordPress CMS. The program exploits 30 vulnerabilities found in various WordPress plugins and themes.
When websites use outdated versions of such plug-ins, which lack critical patches, malicious JavaScripts are injected into the targeted web pages. As a result, users are redirected to other websites whenever they click on any part of the compromised page.
The Trojan was designed for 64-bit versions of Linux, but it can also run on 32-bit versions (if such versions still exist). Its primary function is to compromise websites running the WordPress content management system (CMS) and inject malicious JavaScript into them. These attacks target outdated plugins and themes that contain vulnerabilities which cybercriminals can exploit.
The targeted extensions include the following:
- WP Live Chat Support Plugin
- WordPress – Yuzo Related Posts
- Yellow Pencil Visual Theme Customiser Plugin
- Easysmtp
- WP GDPR Compliance Plugin
- Newspaper Theme on WordPress Access Control (CVE-2016-10972)
- Thim Core
- Google Code Inserter
- Total Donations Plugin
- Post Custom Templates Lite
- WP Quick Booking Manager
- Facebook Live Chat by Zotabox
- Blog Designer WordPress Plugin
- WordPress Ultimate FAQ (CVE-2019-17232 and CVE-2019-17233)
- WP-Matomo Integration (WP-Piwik)
- WordPress ND Shortcodes for Visual Composer
- WP Live Chat
- Coming Soon Page and Maintenance Mode
- Hybrid
A post published by Dr.Web on 30 December 2022 stated that “If websites use outdated versions of such plug-ins, which lack crucial patches, malicious JavaScripts are injected into targeted web pages”.
When users attempt to access the compromised WordPress site, they are redirected to other websites. The attacker selects the target site, which they can then use for phishing, distributing malware or other malicious activities.
These redirects can help you remain undetected and block the spread of phishing, malware and malicious advertising campaigns. However, operators of automatic redirects may also sell their services to other cybercriminals.
The backdoor exploits known vulnerabilities in the aforementioned outdated WordPress plugins and themes to launch these attacks. Malicious actors can control it remotely, whilst the malicious JavaScript is delivered from remote servers.
In its post on the subject, Dr.Web also stated that each of these variants “contains unimplemented functions designed to crack the administrator accounts of targeted websites via brute-force attacks – using known usernames and passwords, as well as specific word combinations”. Furthermore, if this functionality were to be implemented in future versions of this backdoor malware, even plugins with patched vulnerabilities could be successfully exploited.
Malicious actors control the Trojan virus remotely and use the C&C (Command and Control) server to specify the address of the website to be infected. The attackers can also remotely disable the malware, halt its operations and stop the logging of its activities.
Dr. Web also mentions that it contains idle functions that would enable brute-force attacks against website administrator accounts.
To protect against this threat, administrators of WordPress websites must update the themes and plugins running on their sites to the latest available version and replace those that are no longer being developed with supported alternatives.