**Inside WP-SHELLSTORM: How a Forgotten Server Exposed a Mass Website-Hacking Operation**
A cybercriminal crew inadvertently left one of its own servers wide open on the internet for three weeks, exposing the inner workings of a large-scale website-hacking operation. The leaked data included hacking tools, activity logs, and target lists naming more than 1.4 million websites. While far fewer were actually compromised, the exposed files provide researchers with a rare look at how a mass site-hacking operation runs from the inside.
The operation, now tracked as **WP-SHELLSTORM**, is described by threat intelligence firm SOCRadar as a *webshell access brokerage*—a group that breaks into websites at scale, plants hidden backdoors (webshells), and then packages that access for resale.
### A Server Left Open
Two separate research teams independently discovered the same exposed folder. In June 2026, SOCRadar’s threat intelligence team spotted it on a U.S.-based rented server (IP address 137.175.93[.]126) that had **no password** at all. Inside were roughly 800MB of data across 434 files, including webshells, exploit scripts, target lists, command history, and command-and-control settings.
Ctrl-Alt-Intel had also analyzed the same directory earlier, having found it on Hunt.io’s open-directory platform and published its findings in June 2026—well before SOCRadar’s formal report in July. The root cause was a basic mistake: the operator used a simple Python web server to move files and left it running for **22 days**, unintentionally exposing the entire operation.
### How the Attack Works
The crew used publicly known vulnerabilities in website plugins—primarily in **WordPress** and **Joomla**—to build automated scanners. These scanners targeted massive lists of sites pulled from **FOFA**, a Chinese search engine for internet-connected systems (similar to Shodan). When a vulnerable site was found, the attackers could upload a **webshell**, a small script that allows remote command execution, file access, password theft, and lateral movement within the network.
The toolkit included **27 known vulnerabilities**, though only a handful were used heavily. The most successful was a bug in the **Breeze caching plugin** (CVE‑2026‑3844), which the crew fired at over **45,000 targets** and successfully backdoored more than **17,000** of them. However, even this “successful” exploit had a critical limitation: it only works when a specific non-default setting—*“Host Files Locally – Gravatars”*—is enabled, which many Breeze installations do not have.
### The Numbers: Targets vs. Actual Compromise
It’s important to distinguish between **targeted** sites and **compromised** sites. The headline figure of **1.4 million** refers to the number of domains that appeared on the target lists—not how many were actually hacked.
Research teams measured the real compromise rate differently:
– **Ctrl-Alt-Intel** identified 25,195 sites with confirmed or validated signs of compromise.
– **SOCRadar**, counting active webshells, reported over 5,700 live backdoors.
For perspective, a single Joomla vulnerability was tested against more than **560,000 targets** but successfully compromised only **77** sites—highlighting that being on a scan list is not the same as being hacked.
### Tooling and Earlier Campaigns
The main backdoor, a file named **down.php**, was heavily obfuscated across **four layers** and appears to be derived from an open-source Chinese webshell called **BestShell**. Once installed, it could manage files, execute commands, open reverse shells, scan the network, and detect security software running on the host.
For persistent remote access, the attackers used a **SNOWLIGHT dropper** to install **VShell**, a stealthy backdoor that disguises itself as a kernel process named `[kworker/0:2]`. Both tools have been linked in earlier operations—researchers at Sysdig connected the same toolchain to the suspected Chinese state group **UNC5174** in April 2025, though VShell is also widely used by Chinese-speaking cybercrime groups, so attribution remains uncertain.
The server also held traces of a **much earlier campaign**. Before launching the noisy WordPress attacks, the same crew ran a quieter operation in **May 2026** against corporate Java systems. They extracted **613 configuration files** from 11 systems across nine companies in sectors including fintech, e-commerce, logistics, gaming, and electronics.
The haul included cloud credentials for **AWS, Alibaba Cloud, Oracle, Tencent, and DigitalOcean**, database passwords, and **Alipay RSA private keys**. This initial access was gained using an old but reliable bug in **Nacos** (CVE‑2021‑29441), which allows attackers to bypass authentication entirely by spoofing a single web header.
The sequence suggests a deliberate strategy: **first** steal high-value corporate credentials, **then** pivot to mass website compromise for broader financial gain.
### Sloppy Tradecraft
Both research teams assess the operator with **medium-to-high confidence** as **Chinese or Chinese-speaking**, based on:
– Fluent Simplified Chinese in the code and command history
– Reliance on FOFA, which requires a Chinese phone number to register
– Use of tools popular in Chinese-speaking underground forums (such as Godzilla and VShell)
However, the crew was **remarkably careless**:
– They left the server completely unpassworded
– A FOFA configuration file was present and traceable
– An unedited command history essentially documented the entire operation
– After being spotted (sometime between July 2–4), they deleted only a batch of log lines—three weeks too late
This pattern mirrors a similar incident in March 2026, where Russian state-linked group **Fancy Bear (APT28)** was exposed in the same way—via an open directory that leaked phishing tools and logs in an operation Hunt.io called **Operation Roundish**.
### What You Should Do Now
If you manage **WordPress** or **Joomla** sites, take immediate action:
1. **Patch Breeze (CVE‑2026‑3844)** if the *Gravatars* setting is enabled. Update to version **2.4.5** or later.
2. **Treat the Joomla JCE flaw (CVE‑2026‑48907) as urgent**—it is rated maximum severity and is on **CISA’s Known Exploited Vulnerabilities list**, even if it played a minor role in this campaign. Update to **2.9.99.5** or later.
3. **Also check other common plugins**:
– ThemeREX Addons (CVE‑2026‑1969)
– Simple File List (CVE‑2020‑36847)
– Custom CSS JS PHP (CVE‑2026‑6433)
– BerqWP (CVE‑2025‑7443)
– Ninja Forms (CVE‑2026‑0740)
– WavePlayer (CVE‑2025‑12057)
– WPBookit (CVE‑2025‑7852)
– WP File Manager (CVE‑2020‑25213)
4. **Secure Nacos instances**:
– Upgrade to **2.2.1** or later
– Enable authentication (`nacos.core.auth.enabled=true`)
– Rotate all credentials if the instance was ever exposed
5. **Hunt for webshells**:
– Look for suspicious filenames such as `.bd.php`, `.wp-log.php`, and `.brq-*.php`
– Check for processes named `[kworker/X:Y]`. Real kernel threads won’t have an executable, command line, or network sockets. Any that do are likely backdoors.
– Block known infrastructure:
– IP addresses: `137.175.93[.]126`, `43.108.17[.]80`
– Domain: `xs.xxooonline[.]eu[.]cc`
### Final Note
What makes **WP-SHELLSTORM** significant is not technical sophistication, but **effectiveness**. The attackers used widely available exploits, automated scanning, and massive target lists to compromise sites at scale—no zero-day required. The entire operation was only exposed because the criminals forgot to secure their own command center.
—
**Original Article Source**:
https://www.bleepingcomputer.com/news/security/hacker-server-exposed-1-4-million-website-targets-in-webshell-broker-operation/
