WordPress Sites Hijacked for StopAndProtect Malware C2 Servers

Key Takeaways

• A new malware campaign, “StopAndProtect,” is weaponizing thousands of compromised WordPress sites as command-and-control (C2) infrastructure.
• The operation employs a sophisticated double-extortion model, combining ransomware deployment with extensive data exfiltration, including sensitive documents, credentials, and communication logs.
• Initial infection relies on fake CAPTCHA prompts that trick users into executing malicious PowerShell commands.
• Over 6,000 unique victim IP addresses have been identified globally, with the United States, Russia, and India showing the highest infection rates.

A sophisticated new malware operation, dubbed StopAndProtect, is leveraging thousands of hijacked WordPress websites to establish a vast, resilient command-and-control (C2) network. This campaign engages in a dual-pronged attack, combining ransomware deployment with the surreptitious theft of critical corporate data, including confidential documents, system snapshots, user credentials, and active communication records from infected machines worldwide.

Internal logs, inadvertently exposed due to the threat actors’ operational security lapses, reveal a staggering count of over 6,000 distinct victim IP addresses across the globe. The highest concentrations of these infections have been observed in the United States, Russia, and India. The operators actively manage approximately 2,000 compromised WordPress domains, utilizing them as a dynamic and robust infrastructure for distributing malicious payloads, maintaining persistent control channels, and storing exfiltrated data.

Hackers Weaponize WordPress Sites as C2 Servers

The primary method of initial compromise involves injecting deceptive fake CAPTCHA lures directly onto vulnerable WordPress websites. When unsuspecting visitors navigate to these compromised pages, they are confronted with a fraudulent human verification prompt. This prompt instructs them to copy and paste a malicious PowerShell command directly into their system’s terminal.

Upon execution, this command triggers a complex, multi-stage infection process. This sequence is orchestrated by a pair of PowerShell scripts and several modular .NET loaders, culminating in the deployment of a comprehensive suite of malicious tools. This toolkit encompasses ransomware, credential stealers, screen lockers, VBS spreaders, and USB network worms.

As detailed in an investigative report published by Check Point Research, the StopAndProtect operation deviates significantly from typical “smash-and-grab” cyberattacks. Instead, it prioritizes meticulous intelligence gathering and strategic monetization. The threat actors engage in extensive document enumeration, log keystrokes, map connected network shares, capture periodic screenshots, and scrape local communication data. This comprehensive reconnaissance precedes any decision to deploy ransomware, allowing them to target high-value assets effectively.

Security researchers were able to gain insight into the operation’s inner workings due to several compromised WordPress staging servers that were left with exposed PHP endpoints and open directory listings accessible to the public. This oversight allowed researchers to examine internal activity logs, victim telemetry, and even the raw source code of the malicious components. In a particularly revealing incident, one of the operators seemingly infected their own personal machine, inadvertently uploading internal development files. These files included a custom Visual Basic 6 tool designed for the mass management of hijacked WordPress domains, enabling them to toggle fake CAPTCHA overlays and deploy new payloads across their botnet.

This campaign starkly underscores the severe risks associated with unmaintained Content Management Systems. Analysis of one compromised site revealed it had been running without updates since 2021, leaving it exposed to nearly 40 unpatched vulnerabilities. Unaddressed WordPress security flaws and outdated plugins provide adversaries with persistent backdoors, transforming legitimate websites into malicious relays. Addressing these compromised endpoints is crucial for disrupting modern ransomware deployment tactics before adversaries can move laterally within internal networks.

Compromised websites are no longer merely serving as simple phishing hosts or traffic redirectors; they are now being weaponized as fully functional C2 servers, capable of blending malicious communications with legitimate web traffic. This evolution necessitates a heightened focus on web security.

What You Should Do

• For Website Administrators:
  • Enforce rigorous update schedules for WordPress core files, active themes, and all third-party plugins.
  • Regularly scan your website for unauthorized PHP scripts, modified .htaccess files, and suspicious administrator accounts.
  • Implement strong access controls and multi-factor authentication for all administrative interfaces.
• For End Users:
  • Never copy and paste commands into your terminal or command prompt based on prompts from websites, even if they appear to be for “human verification.”
  • Be suspicious of any unexpected CAPTCHA or verification requests on websites.
  • Ensure your operating system and web browsers are kept up to date.
• For Security Teams:
  • Monitor endpoint telemetry for unauthorized PowerShell execution and other anomalous script activity.
  • Implement robust network monitoring to detect unusual outbound data transfers from internal systems.
  • Educate users about social engineering tactics, particularly those involving unexpected command execution prompts.

IOCs

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.