Rewterz Threat Alert – Fake WordPress Plugin Embedded with Cryptocurrency Miner

Severity

High

Analysis Summary

Malicious plugins for WordPress websites are being used not just to maintain access on the compromised server but also to mine for cryptocurrency. 
The components are clones of legitimate software, altered for malicious purposes like content encryption and acquisition of a ransom payment. WordPress Framework is the plugin currently being impersonated and exploited to install ransomware on WordPress sites. It helps attackers gain and maintain unauthorized access to the site environment. The development of the legitimate plugin seems to have stopped in 2011. Despite this, it still has more than 400 active installations.

Apart from scanning for functions that allow command execution at the server level and restricting this privilege to the botmaster, the plugin also carried code to run a Linux binary that mines for cryptocurrency.

Instead of creating a malicious WordPress plugin from scratch, attackers can modify the code of an existing one to include malicious components.

Impact

• Command Execution
• Content Encryption

Indicators of Compromise

MD5

3a88d0ac48cd61d4d7b07a7b7504e822

SHA256

6e1e0517e8d86845b970592ec72a28eea2c5817c5810133290233f0917fec5f8

SHA1

bea781acfe2b6eb9685199d2c295c2573047dfec

Remediation

• Block the threat indicators at their respective controls.
• Do not install unnecessary plugins.
• Check the additional site components when doing a malware cleanup since many times this procedure is limited to WordPress core files. Themes and plugins are often migrated without any prior scrutiny.
• Keep a backup of all website content.