In an attempt to inject malicious JavaScript into WordPress plugins and themes that are outdated, a previously detected Linux malware that is unknown has been found exploiting 30 vulnerabilities.
The targeted website is injected with malicious JavaScript code if any outdated versions of the vulnerable add-ons are used on the site, as they lack crucial fixes, and therefore do not function properly.
Consequently, when a user clicks on any part of a website that is infected, they are redirected to another website such as a malicious one. The malware can be accessed remotely by its operator on both 32-bit and 64-bit Linux systems, as reported by Dr. Web security firm.
This malware is classified as Linux.BackDoor.WordPressExploit.1, and this backdoor is completely controlled remotely by malicious actors. When given the appropriate command, it is capable of carrying out the following illicit actions for the threat actors:-
- Attack a specified webpage (website)
- Switch to standby mode
- Shut itself down
- Pause logging its actions
Primarily, the trojan operates by exploiting WordPress sites using a set of hardcoded vulnerabilities that are run sequentially until one succeeds. Dr. Web researchers said.
Targeted Plugins & Themes
These are the plugins and themes that are being targeted:-
- WP Live Chat Support Plugin
- WordPress – Yuzo Related Posts
- Yellow Pencil Visual Theme Customizer Plugin
- Easysmtp
- WP GDPR Compliance Plugin
- Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972)
- Thim Core
- Google Code Inserter
- Total Donations Plugin
- Post Custom Templates Lite
- WP Quick Booking Manager
- Faceboor Live Chat by Zotabox
- Blog Designer WordPress Plugin
- WordPress Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233)
- WP-Matomo Integration (WP-Piwik)
- WordPress ND Shortcodes For Visual Composer
- WP Live Chat
- Coming Soon Page and Maintenance Mode
- Hybrid
There is a possibility that if a vulnerability is exploited successfully, malicious JavaScript that is downloaded from a remote location will be injected into the targeted page and the page will be infected.
By doing so, the JavaScript is injected so that, no matter what the original contents of the page are, this JavaScript will be initiated first, when the infected page is loaded.
In this situation, every time the user clicks on any part of the infected page, they will be redirected to the website that the attackers want the user to visit once the infected page is loaded.
Cybersecurity researchers also discovered the updated “Linux.BackDoor.WordPressExploit.2” version of this trojan in combination with its current modification of the trojan application.
There is an additional list of exploited vulnerabilities for the following plug-ins, as well as a change to the C&C server and domain address. Below we have mentioned the plugins:-
- Brizy WordPress Plugin
- FV Flowplayer Video Player
- WooCommerce
- WordPress Coming Soon Page
- WordPress theme OneTone
- Simple Fields WordPress Plugin
- WordPress Delucks SEO plugin
- Poll, Survey, Form & Quiz Maker by OpinionStage
- Social Metrics Tracker
- WPeMatico RSS Feed Fetcher
- Rich Reviews plugin
There are a number of new add-ons targeted by the new variant which indicates that the backdoor development is active at the moment as evidenced by the new variant.
