Consequently, when a user clicks on any part of a website that is infected, they are redirected to another website such as a malicious one. The malware can be accessed remotely by its operator on both 32-bit and 64-bit Linux systems, as reported by Dr. Web security firm.
This malware is classified as Linux.BackDoor.WordPressExploit.1, and this backdoor is completely controlled remotely by malicious actors. When given the appropriate command, it is capable of carrying out the following illicit actions for the threat actors:-
- Attack a specified webpage (website)
- Switch to standby mode
- Shut itself down
- Pause logging its actions
Primarily, the trojan operates by exploiting WordPress sites using a set of hardcoded vulnerabilities that are run sequentially until one succeeds. Dr. Web researchers said.
Targeted Plugins & Themes
These are the plugins and themes that are being targeted:-
- WP Live Chat Support Plugin
- WordPress – Yuzo Related Posts
- Yellow Pencil Visual Theme Customizer Plugin
- WP GDPR Compliance Plugin
- Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972)
- Thim Core
- Google Code Inserter
- Total Donations Plugin
- Post Custom Templates Lite
- WP Quick Booking Manager
- Faceboor Live Chat by Zotabox
- Blog Designer WordPress Plugin
- WordPress Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233)
- WP-Matomo Integration (WP-Piwik)
- WordPress ND Shortcodes For Visual Composer
- WP Live Chat
- Coming Soon Page and Maintenance Mode
In this situation, every time the user clicks on any part of the infected page, they will be redirected to the website that the attackers want the user to visit once the infected page is loaded.
Cybersecurity researchers also discovered the updated “Linux.BackDoor.WordPressExploit.2” version of this trojan in combination with its current modification of the trojan application.
There is an additional list of exploited vulnerabilities for the following plug-ins, as well as a change to the C&C server and domain address. Below we have mentioned the plugins:-
- Brizy WordPress Plugin
- FV Flowplayer Video Player
- WordPress Coming Soon Page
- WordPress theme OneTone
- Simple Fields WordPress Plugin
- WordPress Delucks SEO plugin
- Poll, Survey, Form & Quiz Maker by OpinionStage
- Social Metrics Tracker
- WPeMatico RSS Feed Fetcher
- Rich Reviews plugin
There are a number of new add-ons targeted by the new variant which indicates that the backdoor development is active at the moment as evidenced by the new variant.
In order to protect against brute-force attacks, it is imperative that strong passwords are used along with two-factor authentication.
Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book