Categories: Malware

Linux Malware Exploit Over 30 Vulnerabilities in WordPress Themes & Plugins

In an attempt to inject malicious JavaScript into WordPress plugins and themes that are outdated, a previously detected Linux malware that is unknown has been found exploiting 30 vulnerabilities.

The targeted website is injected with malicious JavaScript code if any outdated versions of the vulnerable add-ons are used on the site, as they lack crucial fixes, and therefore do not function properly. 

Consequently, when a user clicks on any part of a website that is infected, they are redirected to another website such as a malicious one. The malware can be accessed remotely by its operator on both 32-bit and 64-bit Linux systems, as reported by Dr. Web security firm.

This malware is classified as Linux.BackDoor.WordPressExploit.1, and this backdoor is completely controlled remotely by malicious actors. When given the appropriate command, it is capable of carrying out the following illicit actions for the threat actors:-

  • Attack a specified webpage (website)
  • Switch to standby mode
  • Shut itself down
  • Pause logging its actions

Primarily, the trojan operates by exploiting WordPress sites using a set of hardcoded vulnerabilities that are run sequentially until one succeeds. Dr. Web researchers said.

Targeted Plugins & Themes

These are the plugins and themes that are being targeted:-

  • WP Live Chat Support Plugin
  • WordPress – Yuzo Related Posts
  • Yellow Pencil Visual Theme Customizer Plugin
  • Easysmtp
  • WP GDPR Compliance Plugin
  • Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972)
  • Thim Core
  • Google Code Inserter
  • Total Donations Plugin
  • Post Custom Templates Lite
  • WP Quick Booking Manager
  • Faceboor Live Chat by Zotabox
  • Blog Designer WordPress Plugin
  • WordPress Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233)
  • WP-Matomo Integration (WP-Piwik)
  • WordPress ND Shortcodes For Visual Composer
  • WP Live Chat
  • Coming Soon Page and Maintenance Mode
  • Hybrid

There is a possibility that if a vulnerability is exploited successfully, malicious JavaScript that is downloaded from a remote location will be injected into the targeted page and the page will be infected. 

By doing so, the JavaScript is injected so that, no matter what the original contents of the page are, this JavaScript will be initiated first, when the infected page is loaded. 

In this situation, every time the user clicks on any part of the infected page, they will be redirected to the website that the attackers want the user to visit once the infected page is loaded.

Cybersecurity researchers also discovered the updated “Linux.BackDoor.WordPressExploit.2” version of this trojan in combination with its current modification of the trojan application.

There is an additional list of exploited vulnerabilities for the following plug-ins, as well as a change to the C&C server and domain address. Below we have mentioned the plugins:- 

  • Brizy WordPress Plugin
  • FV Flowplayer Video Player
  • WooCommerce
  • WordPress Coming Soon Page
  • WordPress theme OneTone
  • Simple Fields WordPress Plugin
  • WordPress Delucks SEO plugin
  • Poll, Survey, Form & Quiz Maker by OpinionStage
  • Social Metrics Tracker
  • WPeMatico RSS Feed Fetcher
  • Rich Reviews plugin

There are a number of new add-ons targeted by the new variant which indicates that the backdoor development is active at the moment as evidenced by the new variant.

In order to protect against brute-force attacks, it is imperative that strong passwords are used along with two-factor authentication.

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost…

1 day ago

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…

3 days ago

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…

3 days ago

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…

3 days ago

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…

3 days ago

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…

3 days ago