In an attempt to inject malicious JavaScript into WordPress plugins and themes that are outdated, a previously detected Linux malware that is unknown has been found exploiting 30 vulnerabilities.
The targeted website is injected with malicious JavaScript code if any outdated versions of the vulnerable add-ons are used on the site, as they lack crucial fixes, and therefore do not function properly.
Consequently, when a user clicks on any part of a website that is infected, they are redirected to another website such as a malicious one. The malware can be accessed remotely by its operator on both 32-bit and 64-bit Linux systems, as reported by Dr. Web security firm.
This malware is classified as Linux.BackDoor.WordPressExploit.1, and this backdoor is completely controlled remotely by malicious actors. When given the appropriate command, it is capable of carrying out the following illicit actions for the threat actors:-
Primarily, the trojan operates by exploiting WordPress sites using a set of hardcoded vulnerabilities that are run sequentially until one succeeds. Dr. Web researchers said.
These are the plugins and themes that are being targeted:-
There is a possibility that if a vulnerability is exploited successfully, malicious JavaScript that is downloaded from a remote location will be injected into the targeted page and the page will be infected.
By doing so, the JavaScript is injected so that, no matter what the original contents of the page are, this JavaScript will be initiated first, when the infected page is loaded.
In this situation, every time the user clicks on any part of the infected page, they will be redirected to the website that the attackers want the user to visit once the infected page is loaded.
Cybersecurity researchers also discovered the updated “Linux.BackDoor.WordPressExploit.2” version of this trojan in combination with its current modification of the trojan application.
There is an additional list of exploited vulnerabilities for the following plug-ins, as well as a change to the C&C server and domain address. Below we have mentioned the plugins:-
There are a number of new add-ons targeted by the new variant which indicates that the backdoor development is active at the moment as evidenced by the new variant.
In order to protect against brute-force attacks, it is imperative that strong passwords are used along with two-factor authentication.
Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book
The Lotus Blossom hacker group, also known as Spring Dragon, Billbug, or Thrip, has been…
A newly identified malware, dubbed "Squidoor," has emerged as a sophisticated threat targeting government, defense,…
Cyber adversaries have evolved into highly organized and professional entities, mirroring the operational efficiency of…
In Q3 2024, Cofense Intelligence uncovered a targeted spear-phishing campaign aimed at employees working in…
The DragonForce ransomware group has launched a significant cyberattack on critical infrastructure in Saudi Arabia,…
In a concerning development, cybersecurity researchers at Trellix have uncovered a sophisticated malware campaign that…