WordPress Backdoor Operation Exposed by Open Server

A cybercrime crew that planted hidden backdoors on WordPress and Joomla websites left one of its own servers wide open on the internet for 22 days, exposing the tools, target lists and activity logs behind a mass site-hacking operation. Researchers from SOCRadar and Ctrl-Alt-Intel independently analyzed the same exposed folder, and their reports show how the group, now tracked as WP-SHELLSTORM, ran a webshell access brokerage: it broke into sites at scale, planted a hidden webshell on each, and resold that access.

The exposed server was a rented machine at the IP address 137.175.93[.]126 in the United States. SOCRadar's threat intelligence team spotted it on June 11, 2026, and found roughly 800 megabytes across 434 files, including webshells, exploit scripts, scan results, the operator's typed command history and command-and-control settings. Ctrl-Alt-Intel had already analyzed the same directory after finding it on Hunt.io's open-directory platform and published its findings on June 22, weeks before SOCRadar's July 9 writeup. The exposure came from a basic mistake: the operator started a simple Python web server to move files and left it running, unprotected by any password, for 22 days.

The crew's method was not sophisticated. It took publicly known vulnerabilities in website plugins, most of them WordPress plugins, and built automated scanners to fire those exploits at enormous target lists pulled from FOFA, a Chinese search engine for internet-connected systems similar to Shodan. When a site ran a vulnerable version, the exploit could upload a webshell, a small script that lets an attacker run commands on the server, read files, steal passwords and move deeper into the network. The toolkit covered 27 known flaws, but a handful did most of the work. The biggest producer was a bug in the Breeze caching plugin for WordPress, tracked as CVE-2026-3844. The crew aimed it at more than 45,000 targets and, by its own count, backdoored over 17,000 of them. That flaw only works when a non-default setting called "Host Files Locally - Gravatars" is switched on, so most Breeze installations were never exposed.

The headline target numbers need a caveat. The 1.4 million figure is the number of domains on the target lists, not the number of sites broken into, and those lists spanned WordPress, Joomla and other platforms. The largest single file held 587,034 Joomla targets. The number actually compromised was far smaller, and the two research teams measured it differently. Ctrl-Alt-Intel's deduplicated count found 25,195 sites with confirmed or validated compromise evidence, while SOCRadar, counting active webshells, put the live figure at 5,700-plus. One flaw shows the gap clearly: a Joomla bug was fired at more than 560,000 targets but landed on only 77 of them. Being on someone's scan list is not the same as being hacked.

The main backdoor was a file named down.php, heavily obfuscated with four layers of protection and apparently derived from an open-source Chinese webshell called BestShell. Once running, it could manage files, run commands, open reverse shells, scan the local network and check which security software the host was running. For the crew's own remote access, a SNOWLIGHT dropper installed VShell, a stealthy backdoor that disguises its process name as [kworker/0:2], mimicking kernel threads to blend into a process list. In April 2025, Sysdig linked this SNOWLIGHT-to-VShell chain to the suspected Chinese state group UNC5174, but VShell is a common tool in Chinese-speaking criminal circles, so its presence alone does not point to a state actor.

The server also held traces of an earlier, quieter campaign. SOCRadar found that in early May 2026, before the noisy WordPress spree, the same crew targeted corporate Java systems. It pulled 613 configuration files from 11 systems across nine companies in fintech, e-commerce, logistics, gaming and electronics. The stolen data included cloud login keys for AWS, Alibaba Cloud, a major enterprise software vendor's cloud, Tencent and DigitalOcean, database passwords, and Alipay RSA private keys. That campaign used CVE-2021-29441, an old and well-known flaw in Nacos, a configuration server, that lets an attacker skip login by faking a single web header. SOCRadar reads the timing as a sequence: grab high-value corporate credentials first, then pivot weeks later to higher-volume backdoor work, a funding round before scaling up.

Both research teams assess with medium-to-high confidence that the operator is Chinese or Chinese-speaking. They point to fluent Simplified Chinese throughout the code and command history, reliance on FOFA, which the researchers note needs a Chinese phone number to register, and tooling such as Godzilla and VShell favored in Chinese-speaking forums. SOCRadar goes further and reads the crew as financially motivated rather than state-directed. Names found in the files, tance, chen-kk and chenyk, are treated as loose leads rather than proof. One loose end stands out: a single IP address in Taiwan made more than 42,000 requests downloading the crew's own tools. It could be a second operator, a customer or another researcher; the logs cannot settle it. For a group running a capable toolchain, the crew was careless. It left the server open, left a FOFA config file that FOFA can trace through its law-enforcement channel, and left an unedited command history that laid the whole operation out. When it finally noticed it had been spotted, sometime between July 2 and July 4, it deleted a batch of log lines, three weeks too late. The blunder is familiar: in March 2026, the same research shop caught Russia's Fancy Bear, also known as APT28, the same way, when a forgotten open directory spilled the group's phishing tools and logs in a campaign Hunt.io called Operation Roundish.

What should site owners do now? If you run any of the targeted software, check it today. These are not obscure bugs: Wordfence tracked tens of thousands of blocked attacks against the Everest Forms Pro flaw, CVE-2026-3300, this spring, and the Joomla JCE editor bug, CVE-2026-48907, is a maximum-severity flaw that CISA has added to its Known Exploited Vulnerabilities list. Patch Breeze to version 2.4.5 or later if the non-default "Host Files Locally - Gravatars" setting is on; it produced the most backdoors here. Treat the Joomla JCE flaw, fixed in version 2.9.99.5, as urgent because it is maximum severity and actively exploited, even though it barely landed in this campaign. Also check other plugins with known flaws: ThemeREX Addons (CVE-2026-1969), Simple File List (CVE-2020-36847; the valid ID, not the now-rejected CVE-2025-34085), Custom CSS JS PHP (CVE-2026-6433), BerqWP (CVE-2025-7443), Ninja Forms uploads (CVE-2026-0740), WavePlayer (CVE-2025-12057), WPBookit (CVE-2025-7852) and WP File Manager (CVE-2020-25213). For Nacos, upgrade to version 2.2.1 or later and turn authentication on with the setting nacos.core.auth.enabled=true; if your i