LevelBlue Analyzes ErrTraffic V3’s EtherHiding-Based ClickFix Campaign
Summary
LevelBlue’s analysis details an ErrTraffic V3 WordPress backdoor, obfuscated scripts and EtherHiding-based C2 resolution for OS-specific ClickFix lures. Reused hardcoded keys may help defenders decrypt traffic and identify related infrastructure.
Key points
- LevelBlue reports that ErrTraffic V3 installs a PHP backdoor in WordPress mu-plugins, where it captures administrator credentials and injects JavaScript beaconing and loader code.
- The loader uses Base64 decoding and a static XOR key to obfuscate scripts, then queries Polygon smart contracts to retrieve attacker-controlled C2 information through EtherHiding.
- The campaign presents OS- and language-specific ClickFix lures, including fake BSOD, reCAPTCHA and Cloudflare challenge pages.
- The lures can lead to OS-specific payloads; the article describes obfuscated PowerShell delivery and payload retrieval over TLS 1.2.
- ErrTraffic’s backend API uses actions including evt, init, cfg and dl, with AES-GCM encryption and a legacy RC4 mode.
- LevelBlue found hardcoded API and backdoor authentication keys; researchers say these weaknesses can help decrypt communications and identify related installations and infrastructure.
Article Details
- Attack Vectors
- ErrTraffic compromises WordPress sites by installing a PHP backdoor in the mu-plugin directory, where it executes on requests and captures administrator credentials.
- Injected footer JavaScript beacons visitor and request attributes to external URLs and loads ErrTraffic functionality.
- ErrTraffic queries Polygon smart contracts through RPC endpoints to retrieve attacker-controlled C2 URLs and payload metadata.
- ClickFix lures imitate prompts such as fake BSOD screens, reCAPTCHA, and Cloudflare challenges; the ErrTraffic lure places an obfuscated PowerShell command on the user's clipboard.
- The campaign delivers OS-specific payloads, including Windows and macOS payloads, from attacker-controlled endpoints.
- Defensive Notes
- The article reports that static analysis of the hardcoded API_Q2_KEY_HEX value can enable reproduction and decryption of ErrTraffic API communications.
- The backdoor's reused authentication key and hardcoded file paths can help identify related backdoor installations and pivot to additional compromised sites.
- The article identifies the Polygon address used for ErrTraffic contract lookups as a way to track contracts and domains associated with newer campaigns.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationErrTraffic uses Base64 decoding and a static XOR key to obfuscate injected JavaScript and payloads.T1056 · Input CaptureThe WordPress backdoor captures administrator credentials and collects visitor and request attributes.T1059.001 · PowerShellClickFix delivers an obfuscated PowerShell command that is placed on the user's clipboard.T1059.007 · JavaScriptInjected JavaScript runs in compromised WordPress site footers and retrieves further ErrTraffic stages.T1071.001 · Web ProtocolsErrTraffic communicates with backend APIs and RPC endpoints over web protocols, with payload downloads using TLS 1.2.T1105 · Ingress Tool TransferThe loader retrieves configuration and OS-specific payloads from attacker-controlled endpoints.T1204 · User ExecutionClickFix lures use fake BSOD, reCAPTCHA, and Cloudflare challenge prompts to persuade visitors to trigger payload execution.T1505.003 · Web ShellErrTraffic installs a PHP backdoor in WordPress mu-plugins to execute automatically on requests.
Vendors
BL Networks[Infrastructure / hosting ] Hosting clusters and ASNs – Omegatech LTD (AS202412) and Cloudflare (AS13335) are primary hosting clusters; BL Networks (AS399629) and Play2go (AS215439) also observed.Cloudflare, Inc.Cloudflare, Inc. (AS13335): The domains (~20) here leverage the Cloudflare infrastructure, primarily through “.workers.dev”.Omegatech LTD[Infrastructure / hosting ] Hosting clusters and ASNs – Omegatech LTD (AS202412) and Cloudflare (AS13335) are primary hosting clusters; BL Networks (AS399629) and Play2go (AS215439) also observed.Play2go International LimitedPlay2go International Limited (AS215439 ): Another smaller cluster (~11 domains) is hosted within this ASN, primarily using the “.cfd” TLD.
Products
Binance Smart Chain (BSC)prepares the next stages of the infection chain by retrieving additional code segments from the Binance Smart Chain (BSC) testnet, a network normally used by developers to test smart contracts before deployment.PolygonThe campaign resolves C2 infrastructure via Polygon smart contracts (EtherHiding) to deliver OS-specific ClickFix lures and payloads while exposing attacker infrastructure through hardcoded cryptographic keys.WordPressSpiderLabs analyzed ErrTraffic V3, a ClickFix-focused Traffic Distribution System that compromises WordPress sites by installing a PHP mu-plugin backdoor to capture administrator credentials, inject obfuscated
Tools
ClearFake[Smart contract addresses used by ClearFake ] C2 and stage retrieval – 0xA1decFB75C8C0CA28C10517ce56B710baf727d2e, 0xf4a32588b50a59a82fbA148d436081A48d80832A.ErrTrafficLevelBlue SpiderLabs analyzed ErrTraffic V3, a ClickFix-focused Traffic Distribution System that compromises WordPress sites by installing a PHP mu-plugin backdoor to capture administrator credentials, inject obfuscated