WordPress sites under attack from newly found Linux trojan
darkreading.com
WordPress sites under attack from newly found Linux trojan
1–10 of 83 posts
Re: WordPress sites under attack from newly found Linux trojan
#2answers, "why you should write your own framework, if you have the knowledge and time."
Re: WordPress sites under attack from newly found Linux trojan
#3"targets 32-bit versions of Linux and also can run on 64-bit versions of the platform."
That narrows it down then.
Re: WordPress sites under attack from newly found Linux trojan
#4"targets 32-bit versions of Linux and also can run on 64-bit versions of the platform." That narrows it down then.
[deleted]
Re: WordPress sites under attack from newly found Linux trojan
#5Website loads as a white page to me.
Even the Google-cached version.
Re: WordPress sites under attack from newly found Linux trojan
#6Website loads as a white page to me. Even the Google-cached version.
[deleted]
Re: WordPress sites under attack from newly found Linux trojan
#7More like "Linux systems under attack from newly-found WordPress trojan"
Re: WordPress sites under attack from newly found Linux trojan
#8Website loads as a white page to me. Even the Google-cached version.
Same. Supposedly this was the first reporting:
Re: WordPress sites under attack from newly found Linux trojan
#9Website loads as a white page to me. Even the Google-cached version.
[deleted]
Re: WordPress sites under attack from newly found Linux trojan
#10I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem.
"Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming language and executes attackers’ commands. Its main functionality is to attack websites based on the WordPress CMS by exploiting vulnerabilities in outdated versions of plugins and themes for this platform. If an attack is successful, the webpages of such sites are injected with a malicious JavaScript that redirects website visitors to other sites."
https://vms.drweb.com/virus/?i=25604695
"Linux.Backdoor.WordPressExploit.2 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming language and executes attackers’ commands. Its main functionality is to attack websites based on the WordPress CMS by exploiting vulnerabilities in outdated versions of plugins and themes for this platform. If an attack is successful, the webpages of such sites are injected with a malicious JavaScript that redirects website visitors to other sites. This backdoor is a modification of the Linux.Backdoor.WordPressExploit.1 malicious application. It differs from it in the address of the C&C server, the address of the domain from which the malicious script is downloaded, and its additional list of vulnerabilities to exploit."