Security breach: hackers inject Monero miners on hundreds of WordPress sites
RegulationBit News Today2 min read
Hackers launched a massive brute-force attack against WordPress sites starting December 18. The campaign, one of the largest ever seen, tried to guess administrator passwords to gain access to thousands of WordPress websites.
Massive brute-force campaign targets WordPress admins
WordPress security firm Wordfence detected the start of the distributed brute-force attack at 3:00 AM UTC on December 18. The brute-force onslaught, which targeted primarily WordPress admin login pages, is still ongoing.
This brute-force attack has seen multiple splashes, peaking at over 14 million attacks per hour. The attacks attempt to access administrator accounts using weak, default, or compromised credentials, as well as common password lists and heuristics based on each site's domain and content. "This is the most aggressive campaign we have seen to date, peaking at over 14 million attacks per hour," said Wordfence founder and CEO Mark Maunder. Requests came from more than 10,000 unique IP addresses, with each IP generating heavy attack volume against roughly 190,000 WordPress sites per hour.
The attackers are clearly looking to hijack WordPress servers for two purposes: as attack points in the campaign itself and as Monero mining machines. Once inside, the attackers install a Monero miner and use the compromised site to launch additional brute-force attacks.
Malware attacks & server compromise
Wordfence uncovered the details of the operation after analyzing a compromised server belonging to one of its customers. Although the exact count of compromised websites has not been established, the attackers have already generated more than $100,000 worth of Monero.
Wordfence identified eight command-and-control servers running an IRC daemon on ports 8080 or 9090.
The attackers do not run both tasks simultaneously; each compromised site is either mining Monero or brute-forcing other WordPress sites. Wordfence discovered that some malware samples included XMRig, software designed to mine Monero using a system's CPU. The botnet also appears to be controlled through IRC servers operating on ports 8080 and 9090.
Mining profits soar as Monero price shoots up
The focus on Monero came as the cryptocurrency's exchange rate almost doubled that month. The attackers took advantage of this and mined around 217 XMR, which at current exchange rates is over $100,000.
Steps for WordPress users to stay safe
Wordfence advised owners of infected sites to clean them immediately to prevent rapid damage to their domain and IP address reputations. Users should also scan their WordPress installation for malware, block malicious IP addresses, and check if their server CPU resource usage is within normal levels.
