cyber.hendryadrian.com
Threat Research · thehackernews.com

Researchers Detail Self-Healing WordPress Backdoor With Blockchain-Based C2

· Original article ↗

Summary

Researchers describe SC, a WordPress backdoor that restores itself from files, the database, plugins, and shared memory, and uses Ethereum for C2. Separately, attackers are exploiting the wpForo plugin’s CVE-2026-1581 flaw.

Key points

  • SC maintains redundant copies across WordPress files, the database, plugins, and System V shared memory, allowing surviving components to restore deleted ones.
  • The backdoor hides from administrator views, creates a hidden administrator account, and uses cron hooks to support reinfection.
  • It communicates with C2 through Ethereum blockchain infrastructure and can retrieve payloads, run PHP, and inject JavaScript into sites.
  • Researchers have not determined how SC is initially delivered; possible vectors include vulnerable plugins or themes, weak credentials, and insecure upload features.
  • The unauthenticated SQL injection CVE-2026-1581 affects wpForo Forum plugin versions through 2.4.14 and has been actively exploited.
  • Previdian telemetry recorded fewer than 20 exploitation attempts since July 3, 2026, from five attacker IP addresses.

Article Details

Attack Vectors
  • The malware's initial delivery method is unknown. Sucuri lists WordPress, plugin, or theme vulnerabilities; weak login credentials; software supply-chain attacks targeting popular plugins; and insecure media or form-upload features used to place PHP web shells as typical possible initial-access vectors.
  • The backdoor maintains persistence across files, the WordPress database, System V shared memory, and plugin locations, and can restore its components from surviving copies.
  • The backdoor communicates with a C2 server using Ethereum blockchain infrastructure, retrieves additional payloads, and can inject arbitrary JavaScript into site visitors.
Defensive Notes
  • Removing a single file or plugin may not stop the infection: the article describes components that can rebuild the backdoor from other files, the database, or shared memory.
  • The article reports active exploitation of CVE-2026-1581 against wpForo Forum versions up to and including 2.4.14.

MITRE ATT&CK

T1053.003 · CronThe infection registers WordPress cron hooks, including randomized names and a known fetch hook; system cron runs the WordPress cron file and triggers scheduled redeployment.

CVE

CVE-2026-1581tomdever · wpForo ForumThe campaign also uses Ethereum blockchain-based command-and-control, while active exploitation has been seen against the wpForo Forum WordPress plugin flaw CVE-2026-1581.

People

Gabriel BarbosaSecurity researcher who described the backdoor's redundant persistence across files, the database, and shared memory.

Malware

SCResearchers uncovered a WordPress compromise where the SC backdoor uses multiple persistence layers across files, the database, shared memory, and plugins to keep restoring itself after removal.

Products

WordPressResearchers uncovered a WordPress compromise where the SC backdoor uses multiple persistence layers across files, the database, shared memory, and plugins to keep restoring itself after removal.wpForo ForumThe campaign also uses Ethereum blockchain-based command-and-control, while active exploitation has been seen against the wpForo Forum WordPress plugin flaw CVE-2026-1581.

Countries

BulgariaThe activity has originated from five unique attacker IP addresses located in Bulgaria, Switzerland, France, the U.S., and Yemen.FranceThe activity has originated from five unique attacker IP addresses located in Bulgaria, Switzerland, France, the U.S., and Yemen.SwitzerlandThe activity has originated from five unique attacker IP addresses located in Bulgaria, Switzerland, France, the U.S., and Yemen.YemenThe activity has originated from five unique attacker IP addresses located in Bulgaria, Switzerland, France, the U.S., and Yemen.

Related Articles