New Ioncube Malware found on hundreds of WordPress and Joomla websites that infect with legitimate Ioncube encoded files.
IonCube is a PHP Encoder that used for Encrypt and protect files with PHP encoding, encryption, obfuscation and licensing capabilities.
This Malware infection discovered in both WordPress and Joomla websites along with thousands of files and it infect the files such as “diff98.php” and “wrgcduzk.php” which is core directories of a WordPress site.
IonCube malware is used by hackers to create backdoor on vulnerable websites allowing them to steal data from the Victims.
Also Read: Penetration testing with your WordPress Website-Detailed Explanation
Initially researchers discovered IonCube Malware WordPress site files that encoded with ionCube, which is one of the oldest and most difficult to reverse PHP obfuscation technologies.
Later further analysis revealed that, it infected Joomla and CodeIgniter sites and this malware visible in almost any web server running PHP.
So Over all, researchers found over 700 infected sites, totalling over 7,000 infected files.
According to sitelock It was also found that the files were not consistently following malicious naming patterns – innocuous files with names such as “inc.php” and “menu.php” also contained this malware.
Fake IonCube files completely pretending as legitimate IonCube files.
Fake ionCube File
Legitimate ionCube File
In this case, Few line exists in the legitimate ionCube file, but not the fake one, and should be present in all recent, legitimate ionCube files.
Every Legitimate Ioncube files reference to the ioncube.com domain but it is not present in the fake files.
“Also researchers notice that the fake file has a code block after the PHP closing tags, much like the legitimate ionCube file. But unlike the real file, this code block consists only of alphanumeric characters and newlines.”
If you or your developer have not specifically and intentionally installed ionCube-encoded files, it is likely that any files claiming to be using ionCube are suspicious, as successfully making use of ionCube typically requires manual server configuration.
Also, cross-compatibility with different versions of PHP is minimal, reducing the viability of use as malware.
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…