Stealthy WordPress Malware Uses Ethereum for C2 and Self-Healing
A sophisticated WordPress malware, disguised as a legitimate must-use plugin, employs novel techniques like Etherhiding and custom obfuscation to evade detection and ensure persistence.
The Wordfence Threat Intelligence Team has uncovered a stealthy and resilient piece of malware targeting WordPress sites. Discovered in mid-June during a routine site cleanup, this malicious software was installed as a 'must-use' plugin, a type of plugin that loads automatically on every WordPress request and cannot be deactivated through the standard dashboard. This strategic placement grants attackers a high degree of persistence and makes removal significantly more challenging.
The malware employs several advanced techniques to evade detection and survive removal attempts. One of its most notable features is 'Etherhiding,' a method that conceals the location of its command and control (C2) servers by leveraging the Ethereum blockchain. This approach makes the C2 channel highly resistant to takedown efforts, as the server infrastructure is not directly exposed.
To further obscure its operations, the malware utilizes custom string obfuscation. Unlike more common obfuscation methods that are easily identifiable, this malware hides API calls and filenames by encoding them. These encoded strings are only decoded at runtime when needed, making static analysis and signature-based detection more difficult. This technique allows the malware to disguise critical functions and file paths, blending in with legitimate WordPress components.
Beyond its evasion tactics, the malware incorporates self-healing mechanisms. These features are designed to automatically restore the malware if an administrator or security tool attempts to remove it. By embedding these recovery routines, the attackers ensure the malware's continued presence on the compromised website, even after initial cleanup efforts.
The malware's distribution is also varied, appearing under thousands of distinct filenames, including legitimate-looking WordPress files like advanced-cache.php and db.php, as well as theme functions.php files. The plugin name, author, and URI fields are also frequently altered, rendering metadata-based detection unreliable. This adaptability makes it challenging to create universal detection signatures.
Wordfence has developed and released a detection signature for this malware, which was immediately available to its Premium, Care, and Response customers. Free version users received the signature after the standard 30-day delay. The company's incident response team investigates such infections, removing the malware and addressing any resulting complications, while adding samples to their extensive Threat Intelligence database.
The primary goal of this malware appears to be data exfiltration, though its stealthy nature and resilience suggest a sophisticated threat actor. The combination of must-use plugin installation, Etherhiding for C2, custom obfuscation, and self-healing capabilities presents a significant challenge for WordPress site owners and security professionals.
This incident highlights the evolving tactics of WordPress attackers, who are increasingly employing advanced techniques to maintain persistence and evade detection. Site owners are advised to maintain robust security practices, including regular scanning with reputable security plugins and prompt application of updates, to protect against such sophisticated threats.
This new report details the malware's sophisticated persistence mechanisms, including its ability to self-repair if deleted and spread to other WordPress sites on the same server. It also elaborates on the custom string-substitution obfuscation used to hide WordPress hook names, option names, file paths, and SQL statements until runtime, making it harder to detect through static analysis.
The SC backdoor, detailed by Sucuri, expands on the techniques previously observed in stealthy WordPress malware. While the existing story highlights Ethereum for C2 and self-healing, SC further distributes its components across files, database, and server memory, enabling surviving parts to restore deleted malware. It also actively hides admin accounts, steals session tokens, and can deliver payment-skimming scripts, demonstrating a more comprehensive and resilient infection mechanism than initially described.
This new report details the specific persistence mechanisms employed by the SC backdoor, describing it as a 'self-healing mesh' that utilizes files, database entries, and shared memory to rebuild itself. The article further breaks down the eight distinct components of the malware, including its use of .user.ini, various PHP files, and a theme-resident twin, offering a deeper technical understanding of its resilience.