Categories: Malware

Over 700 WordPress and Joomla Websites Infected with IonCube Malware

New Ioncube Malware found on hundreds of WordPress and Joomla websites that infect with legitimate Ioncube encoded files.

IonCube is a PHP Encoder that used for Encrypt and protect files with PHP encoding, encryption, obfuscation and licensing capabilities.

This Malware infection discovered in both WordPress and Joomla websites along with thousands of files and it infect the files such as “diff98.php” and “wrgcduzk.php” which is core directories of a WordPress site.

IonCube malware is used by hackers to create backdoor on vulnerable websites allowing them to steal data from the Victims.

Also Read: Penetration testing with your WordPress Website-Detailed Explanation

IonCube Malware with WordPress and Joomla

Initially researchers discovered IonCube Malware WordPress site files that encoded with ionCube, which is one of the oldest and most difficult to reverse PHP obfuscation technologies.

Later further analysis revealed that, it infected Joomla and CodeIgniter sites and this malware visible in almost  any web server running PHP.

So Over all, researchers found over 700 infected sites, totalling over 7,000 infected files.

According to sitelock It was also found that the files were not consistently following malicious naming patterns – innocuous files with names such as “inc.php” and “menu.php” also contained this malware.

Fake IonCube files completely pretending as legitimate IonCube files.

Fake ionCube File

Legitimate ionCube File

In this case, Few line exists in the legitimate ionCube file, but not the fake one, and should be present in all recent, legitimate ionCube files.

Every Legitimate Ioncube files reference to the ioncube.com domain but it is not present in the fake files.

“Also researchers notice that the fake file has a code block after the PHP closing tags, much like the legitimate ionCube file. But unlike the real file, this code block consists only of alphanumeric characters and newlines.”

Mitigation by SiteLock

If you or your developer have not specifically and intentionally installed ionCube-encoded files, it is likely that any files claiming to be using ionCube are suspicious, as successfully making use of ionCube typically requires manual server configuration.

Also, cross-compatibility with different versions of PHP is minimal, reducing the viability of use as malware.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

2 days ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

4 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

4 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago