New Ioncube Malware found on hundreds of WordPress and Joomla websites that infect with legitimate Ioncube encoded files.
IonCube is a PHP Encoder that used for Encrypt and protect files with PHP encoding, encryption, obfuscation and licensing capabilities.
This Malware infection discovered in both WordPress and Joomla websites along with thousands of files and it infect the files such as “diff98.php” and “wrgcduzk.php” which is core directories of a WordPress site.
IonCube malware is used by hackers to create backdoor on vulnerable websites allowing them to steal data from the Victims.
Also Read: Penetration testing with your WordPress Website-Detailed Explanation
IonCube Malware with WordPress and Joomla
Initially researchers discovered IonCube Malware WordPress site files that encoded with ionCube, which is one of the oldest and most difficult to reverse PHP obfuscation technologies.
Later further analysis revealed that, it infected Joomla and CodeIgniter sites and this malware visible in almost any web server running PHP.
So Over all, researchers found over 700 infected sites, totalling over 7,000 infected files.
According to sitelock It was also found that the files were not consistently following malicious naming patterns – innocuous files with names such as “inc.php” and “menu.php” also contained this malware.
Fake IonCube files completely pretending as legitimate IonCube files.
Fake ionCube File
Legitimate ionCube File
In this case, Few line exists in the legitimate ionCube file, but not the fake one, and should be present in all recent, legitimate ionCube files.
Every Legitimate Ioncube files reference to the ioncube.com domain but it is not present in the fake files.
“Also researchers notice that the fake file has a code block after the PHP closing tags, much like the legitimate ionCube file. But unlike the real file, this code block consists only of alphanumeric characters and newlines.”
Mitigation by SiteLock
If you or your developer have not specifically and intentionally installed ionCube-encoded files, it is likely that any files claiming to be using ionCube are suspicious, as successfully making use of ionCube typically requires manual server configuration.
Also, cross-compatibility with different versions of PHP is minimal, reducing the viability of use as malware.
