Australia Warns of Global CMS Exploitation Campaign Deploying Webshells
Summary
Australia’s ACSC warns that a global campaign is exploiting CMS and plugin vulnerabilities to deploy webshells. Many Australian businesses are reportedly affected; administrators are advised to patch, remove unused components and monitor for changes.
Key points
- The Australian Cyber Security Centre says a global campaign is exploiting vulnerabilities in CMS platforms and plugins.
- Many small and medium-sized Australian businesses are reportedly affected.
- Attackers are deploying webshells, which can provide persistent access and enable further malicious activity.
- Products named include WordPress, Craft CMS, MaxSite CMS, MetInfo CMS and Joomla JCE; the alert lists associated vulnerabilities.
- The ACSC says AI may be helping attackers accelerate and scale exploitation.
- Recommended steps include applying updates, removing unused components, restricting sensitive directories and monitoring for unauthorized file creation.
Article Details
- Event Type
- Global campaign exploiting vulnerabilities in content management systems and plugins to deploy webshells.
- Impact
- The Australian Cyber Security Centre reports that many small and medium-sized Australian businesses have been affected. Deployed webshells provide persistent access and can enable service disruption, credential theft, additional malware deployment, and movement deeper into networks.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe campaign exploits vulnerabilities in internet-facing CMS platforms and plugins.T1505.003 · Web ShellThe campaign deploys webshells on vulnerable sites to maintain persistent access.T1595 · Active ScanningThe ACSC says malicious cyber actors are actively scanning websites for opportunities to exploit vulnerabilities.
Products
Craft CMSThe activity targets products including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, and may be assisted by AI to speed up large-scale exploitation.Joomla JCEThe activity targets products including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, and may be assisted by AI to speed up large-scale exploitation.MaxSite CMSThe activity targets products including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, and may be assisted by AI to speed up large-scale exploitation.MetInfo CMSThe activity targets products including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, and may be assisted by AI to speed up large-scale exploitation.WordPressThe activity targets products including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, and may be assisted by AI to speed up large-scale exploitation.