WP-SHELLSTORM Backdoors Thousands of CMS Sites

A financially motivated cybercrime group, tracked as WP-SHELLSTORM, has compromised over 25,000 websites, primarily targeting WordPress and Joomla platforms. The operation functions as a webshell access brokerage, utilizing automated scanners to fire publicly known exploits at a target list of over 1.4 million domains. The campaign relies on Chinese-attributed tradecraft, including the use of FOFA for reconnaissance and Godzilla/BestShell webshells for persistence.

The attack chain involves mass exploitation of plugins—most notably the Breeze caching plugin—followed by the deployment of obfuscated webshells. In a separate, high-value pivot, the group targeted corporate Java (Nacos) environments to exfiltrate cloud credentials for AWS, Alibaba, and Tencent. This highlights a dual strategy: acquiring high-value corporate access followed by high-volume CMS backdooring for broader resale.

While the group demonstrates capable technical tooling like the VShell backdoor, they exhibited poor operational security (OPSEC) by exposing a command-and-control server at 137.175.93[.]126 for three weeks. This exposure allowed researchers to recover target lists, command histories, and exploit scripts, providing a rare look into the inner workings of a mass-exploitation operation.