Malware Campaigns Sharing Network Resources: r00ts.ninja
We recently noticed an interesting example of network infrastructure resources being used over a period of time by more than one large scale malware campaign (e.g redirected traffic, cryptomining). This was discovered when reviewing sources of the various malicious domains used in a recent WordPress plugin exploit wave.
Mass Infection of WordPress Websites
The latest Easy SMTP plugin vulnerability has resulted in many infected WordPress websites. The first wave of exploits seemed to follow a similar methodology as the first wave of GDPR plugin exploits in late 2018:
- The malicious user exploits the vulnerability and enables new user registration with the default user level set to administrator, then creates a new admin user.
Continue reading Malware Campaigns Sharing Network Resources: r00ts.ninja at Sucuri Blog.
