A highly persistent and sophisticated PHP reinfector malware has been discovered targeting WordPress websites, leveraging vulnerabilities such as CVE-2024-22303 and CVE-2024-21743 in the Houzez WordPress theme. This malware exploits multiple attack vectors to embed itself into website files, plugins, and database tables, creating a cycle of reinfection that is challenging to eradicate.
The malware is particularly alarming due to its ability to capture admin credentials, create hidden malicious users, and manipulate WordPress cron tasks for sustained control and malicious activity.
Key Features of the PHP Reinfector Malware
1. Infection Mechanisms
- Embeds itself into WordPress core files, plugins, and critical database tables (e.g., wp_posts, wp_options).
- Exploits backdoors in plugins (e.g., Imagify) to create PHP files and execute arbitrary commands.
- Modifies WordPress functionality to maintain persistence, including tampering with WPCode snippets.
2. Credential Theft
- Captures WordPress admin credentials from login submissions.
- Encodes stolen credentials using Base64 and stores them in server files for later use.
3. Persistent Access
- Creates hidden WordPress admin accounts with random hexadecimal usernames and email addresses.
- These accounts do not appear in the admin panel, making them difficult to detect.
4. Malicious Task Automation
- Manipulates WordPress cron system to execute malicious tasks every 24 hours.
- Injects malicious scripts via third-party URLs, redirecting site visitors to fraudulent domains like VexTrio.
5. Concealment Strategies
- Obfuscates or removes security logs to evade detection by popular WordPress security plugins.
- Uses SQL queries to replace WPCode snippets, hiding its presence from administrators.
Potential Impact
1. Data Breaches
- Theft of admin credentials and other sensitive information.
2. Persistent Malware Infection
- Reinfection occurs if even a fragment of the malware remains, requiring comprehensive removal strategies.
3. Website Defacement and Malicious Redirects
- Redirects site visitors to fraudulent domains, damaging user trust and site reputation.
4. Network Compromise
- Hidden backdoors allow attackers to execute commands, infiltrate systems, and move laterally within the network.
Mitigation Recommendations
- Patch Vulnerabilities
- Update the Houzez theme and any associated plugins to the latest versions addressing CVE-2024-22303 and CVE-2024-21743.
- Secure WordPress Configurations
- Remove the WPCode plugin if it is not essential to your site.
- Regularly audit plugins and themes for integrity and signs of tampering.
- Strengthen Authentication
- Use strong, unique passwords for all WordPress accounts.
- Enable two-factor authentication for an additional layer of protection.
- Monitor and Clean Infections
- Conduct regular scans with reputable security plugins (e.g., Wordfence, Sucuri).
- Inspect logs for unauthorized file creation or login attempts.
- Remove hidden admin accounts and rotate credentials immediately if compromised.
- Implement Defense-in-Depth
- Restrict file write permissions to limit the malware’s ability to embed itself.
- Use a Web Application Firewall (WAF) to block malicious traffic.
- Backup and Recovery
- Maintain regular, secure backups of your website.
- Ensure backups are stored offsite to facilitate recovery after an infection.
Indicators of Compromise (IoCs)
- Presence of hidden admin accounts with random hexadecimal names.
- Base64-encoded credential files on the server.
- Malicious cron jobs executing every 24 hours.
- Redirects to domains like VexTrio.
- Unexpected or obfuscated PHP files in plugin directories (e.g., Imagify).
References and Resources
- Sucuri Analysis: In-depth PHP Reinfector Investigation
- WordPress Security Best Practices: Hardening WordPress
- Related Posts:
- Unpatched WordPress Bug Risks
- WordPress Urgent Security Update
Conclusion
The PHP reinfector malware targeting WordPress sites is a highly advanced and persistent threat that exploits common vulnerabilities to gain control over websites and spread malicious activities. Organizations must act swiftly to patch vulnerabilities, strengthen security practices, and proactively monitor for signs of infection to mitigate the impact of this evolving threat.
Failure to address this issue promptly may result in significant reputational, operational, and financial damages.
