Shade Ransomware Campaign Compromises at Least 500 WordPress and Joomla Websites

Security researchers discovered a hidden HTTP directory that is allowing threat actors to install Shade ransomware on WordPress and Joomla websites.

The campaign has compromised at least 500 online properties and is taking aim at thousands more, Zscaler warned. Victims of the attack were targeted via phishing emails that contained a ZIP file with JavaScript, which in turn downloaded and ran Shade ransomware. The directory is one that website owners often use to prove to certificate authorities that they have rights to a particular domain.

Who’s at Risk of a Web Phishing Attack?

WordPress and Joomla are among the most popular content management systems (CMSs). The current Shade ransomware threat is most likely to affect sites running server-side software and outdated themes or plugins, the researchers said. Those vulnerable include websites running WordPress versions 4.8.9 to 5.1.1.

Using the directory means those behind the attacks can effectively hide the files containing Shade ransomware — otherwise known as Troldesh — from WordPress and Joomla admins, Zscaler added. Once the payload has been executed, threat actors are able to change the wallpaper of a victim’s machine to show a ransom note written in Russian and English.

The attackers have also been careful to use phishing pages that resemble some of the most common productivity tools, including Microsoft OneDrive, DropBox and Gmail. However, there were other pages designed to imitate firms such as Bank of America and DHL, according to screenshots the researchers captured. This means threat actors might easily be able to steal usernames, passwords and other confidential information.

Stopping the Spread of Shade Ransomware

While the source of the current Shade ransomware campaign against WordPress and Joomla users is unknown, security teams should act quickly to limit the potential for similar phishing attacks.

A good incident prevention plan not only includes keeping up to date on current website themes and plugins, but also, as IBM experts recommend, using identity verification and multifactor authentication tools that can spot threats that might be hidden to a website admin.

Shane Schick

Writer & Editor

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

Who’s at Risk of a Web Phishing Attack?

Stopping the Spread of Shade Ransomware

More from

IBM identifies zero-day vulnerability in Zyxel NAS devices

What cybersecurity pros can learn from first responders

Unified endpoint management for purpose-based devices

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

Topic updates