Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

20,000 WordPress Websites Infected via Trojanized Themes

An active supply chain campaign that has been ongoing since late 2017 has infected at least 20,000 websites via malicious WordPress themes and plugins, Prevailion reports.

An active supply chain campaign that has been ongoing since late 2017 has infected at least 20,000 websites via malicious WordPress themes and plugins, Prevailion reports.

Dubbed PHPs Labyrinth, the campaign used 30 different WordPress marketplace platforms to distribute trojanized versions of premium themes. All the suspicious sites feature a similar template and all seem to be operated by the same threat actor.

The most prominent platform distributing the trojanized themes appears to be Vestathemes[dot]com, which claims to be offering thousands of pirated WordPress themes and plugins.

While they discovered signs of compromise on over 20,000 websites all around the world, Prevailion researchers believe that the number of infected sites is much higher, “potentially in the hundreds of thousands.”

Once the victim uploads a trojanized theme, the attackers gain full control over the server, being able to add their own administrative account and recover the web admin’s email and WordPress password hash.

In most cases, the infected servers were added to the Propeller Ads advertising network, which is associated with malvertising, the Fallout exploit kit, and other malicious activities, the researchers note.

All of the trojanized themes contain the “class.theme-module.php” or “class.plugin-modules.php” file, which is added by the attackers. The file can change the command and control (C&C) node periodically, retrieves and writes a first stage C&C, and performs reconnaissance.

The file then checks for the presence of certain files, such as post.php and wp-vcd.php, and creates them if they are not found. Once the new wp-vcd.php file was created, class.theme-module.php is deleted.

Initially, the adversary used CloudFlare, but moved all its sites to a single IP address between December 2019 and January 2020, after Wordfence exposed the attack in November 2019. The threat actor also removed secondary and tertiary communications channels from the infected sites.

Prevailion says the threat actor is using the first stage C&C server to add code to existing files on the infected servers, to run the wp-vcd.php file and download additional code. This includes a persistent cookie served to site visitors arriving from Google, Yahoo, Yandex, MSN, Baidu, Bing, or DoubleClick.

A new segment of code added to functions.php also sends out information such as IP address, bot number, pack, and the user-agent string of the machine. The researchers identified multiple domains referenced in the code, but believe that some of them are relays.

The attackers also attempted to raise the search engine optimization (SEO) profile of their sites, through running a series of commands on the compromised domains. At some point, they also added anti-adblocker code and used it since at least September 2019.

While the victims are spread all around the world across multiple sectors, suggesting that this was not a targeted attack, the researchers did notice that small to medium sized businesses accounted for more than a fifth of compromised entities.

More prominent victims include a decentralized crypto-mining website, a U.S.-based stock trading firm, a small U.S. bank, a government-run petrochemical organization, a U.S. insurance company, a large U.S. manufacturer, a U.S. payment card solutions organization, and an IT services organization in the U.S.

“At this time, the threat actor seems content with generating revenue off the advertising aspect of this campaign; however we cannot ignore the fact that in its present state, it has metastasized into a massive botnet, with all the potential issues that represents. This could also have far reaching impact as it gives other criminals a platform to perform malvertising and use various exploit kits to amplify their reach,” Prevailion concludes.

Related: WordPress Websites Hacked via Vulnerabilities in Two Themes Plugins

Related: Flaw in WordPress Themes Plugin Allowed Hackers to Become Site Admin

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Cybercrime

Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Cybercrime

A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.