Full Report
New WordPress malware disguised as a plugin gives attackers persistent access and injects malicious code enabling administrative control
Analysis Summary
# Tool/Technique: WP-antymalwary-bot.php
## Overview
A dangerous malware variant disguised as a legitimate WordPress plugin. Its purpose is to give threat actors persistent access to infected websites, inject malicious code, and serve unauthorized advertisements to site visitors.
## Technical Details
- Type: Malware (WordPress Plugin Backdoor)
- Platform: WordPress (PHP)
- Capabilities: Persistent access via self-reinstallation, remote code execution (RCE), administrative login bypass.
- First Seen: Discovered on January 22, 2025.
## MITRE ATT&CK Mapping
The observed actions map to several core capabilities associated with web shells and persistence mechanisms:
- **TA0003 - Persistence**
- **T1547.006 - Boot or Logon Autostart Execution: Windows Services** (Though WordPress specific, the concept of automated execution on site load applies, mapped closer to T1190 for web applications)
- **T1190 - Exploit Public-Facing Application**
- **T1190.001 - Exploit Public-Facing Application: Web Application Backdoors** (Primary mapping due to plugin nature)
- **TA0002 - Execution**
- **T1059.005 - Command and Scripting Interpreter: Visual Basic** (Broadly applied to code execution, specifically PHP execution here)
- **TA0005 - Defense Evasion**
- **T1027 - Obfuscated Files or Information** (Through masquerading as a legitimate plugin)
## Functionality
### Core Capabilities
- **Masquerading:** Mimics the structure, formatting, and metadata of a genuine WordPress plugin to evade initial scrutiny.
- **Administrative Login Bypass:** Features an `emergency_login_all_admins` function allowing login via a GET request using a hardcoded password.
- **Remote Code Execution (RCE):** Includes an `execute_admin_command` function accessible via the REST API which executes arbitrary PHP commands without requiring authorization checks.
- **Content Injection:** Capable of injecting malicious PHP code into theme headers (e.g., header.php).
- **Cache Clearing:** Ability to clear plugin caches, potentially to hide operational artifacts.
### Advanced Features
- **Self-Reinstallation/Persistence:** If the plugin file is deleted, it reinstalls itself by modifying the `wp-cron.php` file. This ensures the malware reactivates automatically upon the next site visit, as `wp-cron.php` runs on page loads.
## Indicators of Compromise
- File Hashes: [Not provided in the text]
- File Names: `WP-antymalwary-bot.php`
- Registry Keys: [Not applicable to typical WordPress infection]
- Network Indicators: [No specific C2 domains or IPs provided in the text]
- Behavioral Indicators:
- Modifications to `wp-cron.php` for self-repair/reinstallation.
- Execution of PHP code via REST API calls or GET requests targeting specific functions within the plugin file.
- Unauthorized creation/activation of a plugin resembling "WP-antymalwary-bot" structure.
## Associated Threat Actors
- [No specific threat actor group was named in the provided text; discovered by Wordfence Threat Intelligence during routine operations.]
## Detection Methods
- Signature-based detection: Look for the specific file name `WP-antymalwary-bot.php` or suspicious function names (`emergency\_login\_all\_admins`, `execute\_admin\_command`) within plugin files.
- Behavioral detection: Monitor unauthorized modifications to core WordPress files, especially `wp-cron.php`. Detect REST API calls that attempt to invoke admin-level functions in unknown plugins.
- YARA rules: Can be developed based on signature strings within the PHP code structure.
## Mitigation Strategies
- Patch all vulnerable WordPress installations, themes, and plugins immediately.
- Robust file integrity monitoring (FIM) for WordPress core, themes, and plugins, specifically monitoring `wp-cron.php`.
- Review administrative user lists for externally created accounts with hardcoded password usage patterns (though the hardcoded password is in the malware, not user data).
- Restrict access to the WordPress REST API where possible, or ensure strict authorization checks on all API endpoints.
## Related Tools/Techniques
- Other malicious WordPress plugins or backdoors that utilize WP-Cron for persistence.
- Web shells that rely on REST API or HTTP parameters for remote command execution.