Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: WordPress site administrators
Incident: Deployment of a self-healing, blockchain-controlled backdoor codenamed SC.
Impact: Persistent, unauthorized administrative access that is extremely difficult to eradicate through standard cleanup methods.
Attacker: Unidentified threat actors
Analysis: The SC malware employs an aggressive persistence strategy, distributing its payload across files, databases, and shared memory segments. It leverages a substitution cipher for obfuscation and uses the Ethereum blockchain for command-and-control communication. This circular architecture ensures that removing a single component triggers an immediate restoration from the remaining sources.
Recommendations: Audit .user.ini and mu-plugins for unauthorized entries or auto_prepend_file settings.; Implement file integrity monitoring to detect unexpected modifications to core WordPress files.; Perform a full site restoration from a known-clean backup rather than attempting manual file cleanup.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source