Misconfigured C2 Server Uncovers WP-SHELLSTORM Operation Behind Mass WordPress Backdoor Infections
WP-SHELLSTORM
For a three-week window, a threat actor's own infrastructure was left exposed on the open internet—inadvertently revealing the internal machinery behind an active intrusion campaign, including its tooling, operational logs, and a target list spanning more than 1.4 million domains.
While the actual number of successfully compromised sites was considerably smaller than the target list, the exposed data gave researchers rare visibility into the operational mechanics of a large-scale website compromise campaign.
Now tracked under the designation WP-SHELLSTORM, the operation functions as what SOCRadar categorizes as a webshell access brokerage—a threat actor that performs mass exploitation of vulnerable sites, deploys a persistent webshell backdoor on each compromised host, and subsequently monetizes that access by selling it to third parties.
The bulk of exploitation activity targeted WordPress installations running outdated plugin versions. For administrators running WordPress or Joomla environments, the two vulnerabilities of greatest relevance were found in the Breeze caching plugin and Joomla's JCE editor.
The operators built a scanning pipeline that paired known CVEs in WordPress plugin ecosystems with automated exploitation. Rather than developing novel vulnerabilities, they weaponized already-disclosed bugs, using FOFA (a Chinese equivalent to Shodan for indexing internet-facing assets) to enumerate candidate hosts running fingerprinted, vulnerable plugin versions at scale.
Once a target was confirmed to be running an exploitable build, the scanner chained directly into payload delivery — dropping a webshell onto the compromised host. This gave the operators persistent remote code execution: arbitrary command execution on the server, filesystem read/write access, credential harvesting, and a foothold for lateral movement into the broader network.
The toolkit's exploit library spanned 27 distinct CVEs, but the results were heavily concentrated in a handful of high-yield bugs. The standout was CVE-2026-3844, a vulnerability in the Breeze caching plugin. The group scanned and attacked over 45,000 candidate targets running the vulnerable plugin version, and by their own internal tallies, successfully deployed webshells to more than 17,000 of them — a compromise rate north of 35%.
the files:
The primary implant, deployed as down.php- employed multi-stage obfuscation — four sequential layers of encoding/packing before the actual payload logic executed. Code-level analysis suggests it was adapted from BestShell, an open-source Chinese-origin webshell framework, rather than built from scratch. Once decoded and running server-side, it functioned as a full-featured post-exploitation module: file management (upload, download, edit, delete), arbitrary command execution, on-demand reverse shell initiation, internal network reconnaissance, and enumeration of installed security products (AV/EDR fingerprinting) to inform evasion.
For their own C2 access rather than the disposable webshell layer, the operators relied on a SNOWLIGHT-based dropper to stage and install VShell, a more sophisticated backdoor built for stealth. VShell masks its presence at the process level by spoofing its name as [kworker/0:2] — mimicking the naming convention of Linux kernel worker threads — making it far less likely to be flagged during manual inspection of running processes or basic ps/top triage.
patching you should do:
WordPress and Joomla — priority patches: Update Breeze to 2.4.5 or later (CVE-2026-3844) if the non-default "Host Files Locally – Gravatars" option is enabled — this configuration accounted for the majority of successful backdoor installs observed in this campaign. Equally critical is the Joomla JCE vulnerability (CVE-2026-48907, resolved in 2.9.99.5): despite its minimal footprint in this particular operation, it carries a maximum CVSS score and appears on CISA's Known Exploited Vulnerabilities catalog, warranting immediate remediation regardless of observed prevalence.
WordPress and Joomla — secondary review: Also audit installations for ThemeREX Addons (CVE-2026-1969), Simple File List (CVE-2020-36847), Custom CSS JS PHP (CVE-2026-6433), BerqWP (CVE-2025-7443), the Ninja Forms upload component (CVE-2026-0740), WavePlayer (CVE-2025-12057), WPBookit (CVE-2025-7852), and WP File Manager (CVE-2020-25213). Note a tracking discrepancy: some sources reference Simple File List under CVE-2025-34085, which has since been withdrawn as a duplicate entry — CVE-2020-36847 is the authoritative identifier.
Nacos: Upgrade to version 2.2.1 or newer and enforce authentication by setting nacos.core.auth.enabled=true. If the instance was ever internet-reachable without auth, assume full credential compromise — rotate everything stored within it, not only the credentials that seem obviously sensitive.
XXL-Job and Spring Boot: Lock down executor endpoints that lack authentication controls, and disable the /actuator/heapdump endpoint in any production environment.
Threat hunting steps: Scan for filename signatures associated with this actor's webshells, including .bd.php,.wp-log.php, and .brq-*.php patterns. Separately, audit any process labeled [kworker/X:Y]. Legitimate kernel worker threads don't execute a backing program, meaning /proc//exe resolves to nothing, and they show no command-line arguments and no open network sockets. Any [kworker]-named process exhibiting even one of these traits should be treated as a masquerading implant. Additionally, block known malicious infrastructure at the network layer: IPs 137.175.93[.]126 and 43.108.17[.]80, plus the domain xs.xxooonline[.]eu[.]cc.
