ErrTraffic MU-Plugin Backdoor Deployment

Ethan Andrews@eandrews

•updated Jun 16, 2026•3•0•8

Detects the deployment of the 'session-manager.php' MU-Plugin backdoor characteristic of the ErrTraffic 'Analytics' cluster on WordPress servers by monitoring file creation events in the 'wp-content/mu-plugins' directory for the specific filename 'session-manager.php'.