Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Hackers Compromise Hundreds of WordPress Pages

Researchers at M86 Security say hackers have compromised hundreds of Web sites that use Wordpress as part of an attack campaign using the Phoenix exploit kit.

“A few days ago, hundreds of websites, based on WordPress 3.2.1, were compromised,” blogged Daniel Chechik, security researcher at M86 Security. “The attacker uploaded an HTML page to the standard Uploads folder and that page redirects the user to the Phoenix Exploit Kit. Its logs show that users from at least four hundred compromised sites were redirected to Phoenix exploit pages.”

Researchers at M86 Security say hackers have compromised hundreds of Web sites that use WordPress as part of an attack campaign using the Phoenix exploit kit.

“A few days ago, hundreds of websites, based on WordPress 3.2.1, were compromised,” blogged Daniel Chechik, security researcher at M86 Security. “The attacker uploaded an HTML page to the standard Uploads folder and that page redirects the user to the Phoenix Exploit Kit. Its logs show that users from at least four hundred compromised sites were redirected to Phoenix exploit pages.”

According to M86, the content uploaded by the attacker is not part of the homepage and will not show up when users browse these sites. In fact, accessing any page on the compromised WordPress sites other than the uploaded page will not infect the user, the company said.

“The general motivation of attackers to compromise websites is mainly to bypass URL reputation mechanisms, spam filters and certain security policies,” Chechik explained. “In order to lure users to these pages, the attacker sent thousands of malicious emails querying an unfamiliar bill and asking recipients to click on a link as described by Websense blog. The link points to the aforementioned uploaded page.”

“The exploit page is hosted in a Russian domain called horoshovsebudet which roughly translates as “Everything will be fine”, showing a certain sense of humor by these attackers,” he added. “The Phoenix Exploit Kit identifies the User Agent of the client machine and delivers a customized exploit Web page…(that) generates code which attempts exploiting multiple vulnerabilities in Microsoft Internet Explorer, Adobe PDF, Flash and Oracle Java as described in the Phoenix Exploit Kit blog. Among those exploits is the latest Java Rhino vulnerability as shown in the following screenshot and taken from the original malicious server.”

The Phoenix exploit kit has a long history on the cyber-underground. First spotted in 2007, the source code for version 2.5 was first reported leaked last April, forcing the author to update the tool shortly thereafter.

More information on the exploit kit can be found here.

Written By

Click to comment

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Cybercrime

Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.