Stealthy WordPress Malware Uses Ethereum for C2 and Self-Healing
A sophisticated WordPress malware, disguised as a legitimate must-use plugin, employs novel techniques like Etherhiding and custom obfuscation to evade detection and ensure persistence.
The Wordfence Threat Intelligence Team has uncovered a stealthy and resilient piece of malware targeting WordPress sites. Discovered in mid-June during a routine site cleanup, this malicious software was installed as a 'must-use' plugin, a type of plugin that loads automatically on every WordPress request and cannot be deactivated through the standard dashboard. This strategic placement grants attackers a high degree of persistence and makes removal significantly more challenging.
The malware employs several advanced techniques to evade detection and survive removal attempts. One of its most notable features is 'Etherhiding,' a method that conceals the location of its command and control (C2) servers by leveraging the Ethereum blockchain. This approach makes the C2 channel highly resistant to takedown efforts, as the server infrastructure is not directly exposed.
To further obscure its operations, the malware utilizes custom string obfuscation. Unlike more common obfuscation methods that are easily identifiable, this malware hides API calls and filenames by encoding them. These encoded strings are only decoded at runtime when needed, making static analysis and signature-based detection more difficult. This technique allows the malware to disguise critical functions and file paths, blending in with legitimate WordPress components.
Beyond its evasion tactics, the malware incorporates self-healing mechanisms. These features are designed to automatically restore the malware if an administrator or security tool attempts to remove it. By embedding these recovery routines, the attackers ensure the malware's continued presence on the compromised website, even after initial cleanup efforts.
The malware's distribution is also varied, appearing under thousands of distinct filenames, including legitimate-looking WordPress files like advanced-cache.php and db.php, as well as theme functions.php files. The plugin name, author, and URI fields are also frequently altered, rendering metadata-based detection unreliable. This adaptability makes it challenging to create universal detection signatures.
Wordfence has developed and released a detection signature for this malware, which was immediately available to its Premium, Care, and Response customers. Free version users received the signature after the standard 30-day delay. The company's incident response team investigates such infections, removing the malware and addressing any resulting complications, while adding samples to their extensive Threat Intelligence database.
The primary goal of this malware appears to be data exfiltration, though its stealthy nature and resilience suggest a sophisticated threat actor. The combination of must-use plugin installation, Etherhiding for C2, custom obfuscation, and self-healing capabilities presents a significant challenge for WordPress site owners and security professionals.
This incident highlights the evolving tactics of WordPress attackers, who are increasingly employing advanced techniques to maintain persistence and evade detection. Site owners are advised to maintain robust security practices, including regular scanning with reputable security plugins and prompt application of updates, to protect against such sophisticated threats.