Hackers Hijack Thousands of WordPress Sites to Use as C2 Servers for StopAndProtect Malware
A newly uncovered malware operation dubbed StopAndProtect is transforming thousands of hacked WordPress websites into a sprawling criminal command-and-control (C2) infrastructure.
The campaign blends double-extortion ransomware with covert data theft, quietly harvesting sensitive corporate documents, system screenshots, user credentials, and active communication logs from compromised machines worldwide.
Internal logs exposed through the threat actors’ operational security failures reveal over 6,000 unique victim IP addresses across the globe, with the highest infection rates concentrated in the United States, Russia, and India.
The operators actively manage close to 2,000 compromised WordPress domains, creating a resilient, rotating pool of infrastructure to distribute payloads, maintain control channels, and store exfiltrated files.
Hackers Turn WordPress Sites Into C2 Servers
The initial compromise vector relies on deceptive fake CAPTCHA lures injected directly into vulnerable WordPress websites.
When visitors land on compromised pages, they are presented with a fraudulent human-verification prompt instructing them to copy and paste a malicious PowerShell command into their terminal.
Once executed, the command initiates a multi-stage infection sequence driven by dual PowerShell scripts and modular .NET loaders, ultimately deploying a versatile toolkit that includes ransomware, credential stealers, screen lockers, VBS spreaders, and USB network worms.
As detailed in the investigative report published by Check Point Research, the operation departs from conventional smash-and-grab attacks by prioritizing intelligence gathering and selective monetization.
Threat actors conduct extensive document enumeration, log keystrokes, map connected network shares, capture periodic screenshots, and scrape local communication data before deciding whether to deploy ransomware.
Several compromised WordPress staging servers left exposed PHP endpoints and open directory listings accessible to the public, allowing security researchers to inspect internal activity logs, victim telemetry, and raw source code.
In one notable instance, the operator apparently infected their personal machine and inadvertently uploaded internal development files, including a custom Visual Basic 6 tool used to mass-manage hijacked WordPress domains, toggle fake CAPTCHA overlays, and deploy new payloads across the botnet.
The campaign highlights the severe risks of unmaintained Content Management Systems. One analyzed site had been operating without updates since 2021, exposing nearly 40 unpatched vulnerabilities.
Unaddressed WordPress security flaws and outdated plugins provide adversaries with persistent backdoors to convert legitimate websites into malicious relays.
Addressing these compromised endpoints is vital to disrupting modern ransomware deployment tactics before adversaries move laterally across internal networks.
Compromised websites are no longer serving solely as simple phishing hosts or traffic redirectors; they are now weaponized as fully functional C2 servers that blend malicious communications with legitimate web traffic.
Website administrators must enforce rigorous update schedules across WordPress core files, active themes, and third-party plugins while regularly scanning for unauthorized PHP scripts, modified .htaccess files, and suspicious administrator accounts.
End users should treat any website prompting terminal command execution as an immediate compromise attempt, and security teams must monitor endpoint telemetry for unauthorized PowerShell execution and anomalous outbound data transfers.
IOCs
| compromised websites | maximumrock[.]ro platinumcar[.]ca norakremer.co[.]uk pharmart[.]ae ksr-racingparts[.]com |
| compromised base C&C websites | v-k.com[.]ua www.lapellelaser[.]pl www.parsrulman[.]com mectcalcutta[.]com discherniation[.]com |
| PowerShell script stage 1 | cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0 |
| PowerShell script stage 2 | cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9 |
| stage 1 – downloader | 99bcb531d6dd3c93d3f28f03d6e4659c865a4ffbd2fb514e809017f3446a940b 8337bf29100a5871b1275227006dc2a43b21b751e5ce7e2032364fd78af59ac5 4dee2fe98d4da75ffb259c03b50202212dafc85691429a28641a8068eddea504 |
| stage 2 – downloader & loader | 9765b1342cc7eb982a73bb1f94c6c500b63dc817073b76ea926c1097078d3527 7d3604d0728b242c72bd144b8661ebf63c1042a4f5dd441bc8c8507c701df20c 976cfa57e1efacbe517b7e3441e9473d275ec1d9ad8ab69ddf8ae3a966aaa153 |
| stage 3 – encryptor | b79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c79489 65550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe72143 0080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b40 |
| stage 3 – SMB/USB worm | 8d1e23630a6695fa9c793d73832f59436c98bba30ed81c16d01b549bd17feab4 10babb15e08f9fbd72cce11713a273b971c910dd5bdb989a3f6ff4d9c8e372c0 f042240c3de00c46dee625916bf246b7e87481e4081a6a97208b091409766e41 |
| stage 3 – lockscreen | 11a635d70444605ede1de0aa227a9fd7cfa4554e75bea93ce18b639ca571a42e 2adbb2c206be7f23bf77f8f50d1ac0f809511c0b4591421931f81a6eaa42c68c 38602b76f6c65644b01fa4d81708251c159a883253cda8876396dc7212324ab9 |
| stage 3 – credential stealer | 23cbabfe3ca3a7f1eb365f772d6a4ed8095cb8f7755622cc82e804478259dc70 |
| stage 3 – VBS spreader | b3dff910b350ace27d64cbd79405cb154a1967e366d7b88170c3e8303b1d08ad |
| stage 3 – chat utility | 3ed8f2cc8da4853fd770ff38f0cbce6d9d4a84e75a828fc0cec3e3ec60db94f9 3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8 |
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Hackers Hijack Thousands of WordPress Sites to Use as C2 Servers for StopAndProtect Malware appeared first on Cyber Security News.
>>More