WordPress Admins Infect Their Sites With WP-VCD via Pirated Plugins

guest · Nov 5, 2019

WordPress Admins Infect Their Sites With WP-VCD via Pirated Plugins
November 5, 2019
https://www.bleepingcomputer.com/ne...-their-sites-with-wp-vcd-via-pirated-plugins/

WordPress sites have been the target of a highly active malicious campaign that infects them with a malware dubbed WP-VCD that hides in plain sight and quickly spreads to the entire website.
The malware is also "installed on more new sites per week than any other malware in recent months" and "the campaign shows no signs of slowing down."
Pirated plugins and compromised sites used for distribution
While threat actors usually take advantage of CMS security vulnerabilities impacting the WordPress platform to infiltrate websites and inject malicious code, in the case of WP-VCD the webmasters are the ones who spread the infection to their websites.

To be able to build such an efficient distribution platform promoting their malware riddled sites, WP-VCD's operators made use of extensive viral marketing via black hat SEO tricks like backlink and keyword injection within sites they compromised.
Click to expand...

WP-VCD infection and monetization
"The WP-VCD malware propagates across that site, and potentially more if present in the same hosting environment, and injects backlinks into all of them. These backlinks go onto drive even more traffic to the infected nulled themes, and the cycle continues."
The WP-VCD group uses the network of infected WordPress sites for viral marketing that allows them to quickly rack up ad revenue.

"Behind the scenes, extensive command and control (C2) infrastructure and self-healing infections allow attackers to maintain a persistent foothold on these infected sites," Wordfence threat analyst Mikey Veenstra found.
Click to expand...

Wordfence: WP-VCD: The Malware You Installed On Your Own Site

guest · Feb 19, 2020

Over 20,000 WordPress Sites Run Trojanized Premium Themes
February 19, 2020
https://www.bleepingcomputer.com/ne...ordpress-sites-run-trojanized-premium-themes/

A threat actor that has infected more than 20,000 WordPress sites by running the same trick for at least three years: distributing trojanized versions of premium WordPress themes and plugins.

The operation counts tens of unofficial marketplaces, likely managed by the same actor, specifically set up to provide nulled (pirated) WordPress components.
Once the victim uploads a compromised component to the web server, the threat actor can add an administrative account and initiate the attack stages that precede ad-fraud and serving exploit kits to website visitors.

Behind the takeover is the WP-VCD malware that has been documented in security reports since February 2017 and reported by users on various support forums.
The objective of the operation, which Prevailion named 'PHP's Labyrinth,' is multi-pronged, search engine optimization (SEO) being one aspect. This side of the campaign aims at increasing visibility of the sites the attacker controls to ensnare more victims.
Click to expand...

The attacker makes money from showing ads on compromised websites. the network used for this is Propeller advertising service, which has been used in the past for nefarious purposes, malvertising pushing the Fallout Exploit Kit, in particular.
According to Prevailion, the ads displayed by the threat actor were benign and gained them half a cent for each click. Malicious use was also observed, though, for prompting users to download adware that was likely pushing malicious software.
Click to expand...

ZDNet: WordPress botnet deploys anti-adblocker script to make sure its spammy ads are profitable

The threat actor behind the internet's largest WordPress botnet is using an anti-adblocker script to make sure the ads they inject on hacked sites are showing up in users' browsers and generating a profit.
NO NEED FOR PIRATED THEMES ANYMORE
In hindsight, there is no reason why a botnet like WP-VCD should even exist nowadays, let alone be one of the biggest WordPress botnets around.

The practice of downloading pirated themes was fashionable a few years back when commercial themes were expensive, and most WordPress free themes were featureless and kind of useless.
Click to expand...

Prevailion: PHP’s Labyrinth - Weaponized WordPress Themes & Plugins

guest · Mar 25, 2020

WordPress Malware Distributed via Pirated Coronavirus Plugins
March 25, 2020
https://www.bleepingcomputer.com/ne...-distributed-via-pirated-coronavirus-plugins/

The threat actors behind the WordPress WP-VCD malware have started to distribute modified versions of Coronavirus plugins that inject a backdoor into a web site.

The WP-VCD family of WordPress infections are distributed as nulled, or pirated, WordPress plugins that contain modified code that injects a backdoor into any themes that are installed on the blog as well as various PHP files.
The ultimate goal of these malicious plugins is to use the compromised WordPress site to display popups or perform redirects that generate revenue for the threat actors.
Pirated Coronavirus plugins spread WP-VCD
Recently MalwareHunterTeam shared some samples of WordPress plugins with BleepingComputer that were being flagged on VirusTotal as 'Trojan.WordPress.Backdoor.A'.

After BleepingComputer analyzed them, we found that all of these plugins contained a 'class.plugin-modules.php' file that contained malicious code and various base64 encoded strings that are commonly associated with WP-VCD plugins.
Click to expand...

Protecting your WordPress sites from WP-VCD
As the WP-VCD malware is spread through pirated WordPress plugins, the best way to avoid having your site infected is to not download any plugins from unauthorized sites.
Click to expand...

Log in or Sign up

WordPress Admins Infect Their Sites With WP-VCD via Pirated Plugins

guest Guest

guest Guest

guest Guest

Log in or Sign up

WordPress Admins Infect Their Sites With WP-VCD via Pirated Plugins

guest Guest

guest Guest

guest Guest

Useful Searches