A report published last week by Sucuri revealed that threat actors have been observed secretly installing backdoors into websites using legitimate but outdated WordPress plugins as part of an ongoing campaign. increase.
The plugin in question is Eval PHP released by a developer named flashpixx. This allows a user to insert posts from her PHP code page and WordPress site, and it will be executed every time the post is opened in her web browser.
Eval PHP hasn’t received an update in 11 years, but according to statistics collected by WordPress, it’s installed on over 8,000 websites, with an average of 1 or 2 downloads since September 2022. , which jumps to 6,988 on March 30, 2023.
It was downloaded 2,140 times on April 23, 2023 alone. This plugin has been downloaded 23,110 times by him in the last 7 days.
GoDaddy-owned Sucuri says it has confirmed that malicious code has been injected into the infected website’s database into the ‘wp_posts’ table, which stores the site’s post, page, and navigation menu information. . The requests originate from three different IP addresses based in Russia.
“This code is very simple. It uses the file_put_contents function to create a PHP script in the document root of a website with a specific remote code execution backdoor,” said security researcher Ben Martin. I’m here.
The injection in question drops a traditional backdoor into the file structure, but a combination of legitimate plugins and backdoor droppers in WordPress posts can easily reinfect websites and remain hidden. increase. All the attacker needs to do is insert one of the infected posts or pages and a backdoor into the file structure. ”
Sucuri said it has detected over 6,000 instances of this backdoor on compromised websites over the past six months, describing its pattern of injecting malware directly into databases as a “new and interesting development.”
Zero Trust + Deception: Learn How to Outsmart Attackers!
See how Deception can detect advanced threats, stop lateral movement, and strengthen your Zero Trust strategy. Join us for an insightful webinar!
Save my seat!
The attack chain installs the Eval PHP plugin on the compromised site and exploits it to establish a persistent backdoor across multiple posts, sometimes saved as drafts.
“The way the Eval PHP plugin works, it’s enough to save the page as a draft and run the PHP code inside. [evalphp] shortcode,” Martin explained, adding that the malicious page was created with a real site administrator as the author, suggesting the attacker was able to successfully sign in as a privileged user.
This development once again shows how malicious actors can try different methods to maintain a foothold in compromised environments and evade server-side scanning and file integrity monitoring.
Site owners are encouraged to secure their WP admin dashboard and watch out for suspicious logins to prevent attackers from gaining admin access and installing plugins.
