ShapedPlugin - File Drop Followed by Custom Port Exfiltration

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

Correlates the dropping of 'install-persistent.php' within a 'woocommerce' folder with a subsequent network connection to the C2 IP '194.76.217.28' on custom port '2871' within a one-hour window. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels.