Researchers at M86 Security say hackers have compromised hundreds of Web sites that use WordPress as part of an attack campaign using the Phoenix exploit kit.
“A few days ago, hundreds of websites, based on WordPress 3.2.1, were compromised,” blogged Daniel Chechik, security researcher at M86 Security. “The attacker uploaded an HTML page to the standard Uploads folder and that page redirects the user to the Phoenix Exploit Kit. Its logs show that users from at least four hundred compromised sites were redirected to Phoenix exploit pages.”
According to M86, the content uploaded by the attacker is not part of the homepage and will not show up when users browse these sites. In fact, accessing any page on the compromised WordPress sites other than the uploaded page will not infect the user, the company said.
“The general motivation of attackers to compromise websites is mainly to bypass URL reputation mechanisms, spam filters and certain security policies,” Chechik explained. “In order to lure users to these pages, the attacker sent thousands of malicious emails querying an unfamiliar bill and asking recipients to click on a link as described by Websense blog. The link points to the aforementioned uploaded page.”
“The exploit page is hosted in a Russian domain called horoshovsebudet which roughly translates as “Everything will be fine”, showing a certain sense of humor by these attackers,” he added. “The Phoenix Exploit Kit identifies the User Agent of the client machine and delivers a customized exploit Web page…(that) generates code which attempts exploiting multiple vulnerabilities in Microsoft Internet Explorer, Adobe PDF, Flash and Oracle Java as described in the Phoenix Exploit Kit blog. Among those exploits is the latest Java Rhino vulnerability as shown in the following screenshot and taken from the original malicious server.”
The Phoenix exploit kit has a long history on the cyber-underground. First spotted in 2007, the source code for version 2.5 was first reported leaked last April, forcing the author to update the tool shortly thereafter.
More information on the exploit kit can be found here.