Discovery & Initial Access

The investigation commenced with a deep-dive analysis of the server access logs. We quickly determined that the initial entry point was not an exotic zero-day vulnerability, but rather a persistent and aggressive credential brute-force attack targeting the WordPress admin portal (/wp-login.php).

The threat actors utilized a distributed botnet, cycling through various IP addresses to test common username and password combinations. Interestingly, the attacker's automated script contained a critical operational security flaw: the password being tested was incorrectly sent in the HTTP User-Agent header.

This forensic artifact allowed us to pinpoint the exact moment of successful authentication and identify the compromised password from the raw access logs:

167.100.106.54 - - [31/May/2026:20:05:47 +0100] "POST /wp-login.php HTTP/1.1" 302 0 "https://target-site.com//wp-login.php" "[REDACTED_PASSWORD]"
167.100.106.54 - - [31/May/2026:20:05:48 +0100] "GET /wp-admin/ HTTP/1.1" 200 89192 "https://target-site.com//wp-login.php" "[REDACTED_PASSWORD]"

The Malware Artifact

Once authenticated as an administrator, the attacker abused the plugin installation feature to upload multiple ZIP files masquerading as legitimate tools. These directories contained deeply nested PHP web shells designed to blend seamlessly with normal core files.

During our forensic extraction, we isolated the primary backdoor. To demonstrate the severe capabilities of this malware, we have safely rendered the exact graphical interface extracted from the backup below. This is not an approximation—this is the actual tool the attackers used to navigate the compromised server.

Note: All malicious functionality has been entirely stripped. This is a defanged educational demonstration.

Evasion & Obfuscation Analysis

The most sophisticated aspect of this attack was the "listener script" hidden deep within the fake plugin architecture. This script served as an advanced loader engineered explicitly to bypass static Antivirus signatures and Web Application Firewalls (WAF).

Dynamic Function Resolution

To avoid triggering alarms, the script abstained from using recognizable, highly-flagged PHP function names like eval, base64_decode, or gzuncompress. Instead, it dynamically constructed these names at runtime using XOR mathematics and character concatenation.

// Reconstructing 'base64_decode' in memory to bypass static scanning
// The malware used complex XOR math and additions so strings never appear in plaintext
$func = chr(138^249) . chr(36-36+116) . chr(214^185) . chr(112+(93^93)) /* ... */ ;
// Ultimately resolving to:
$func($payload);

The Decryption Pipeline

The primary web shell payload was hidden within a massive Base64 string. Before execution, it passed through a rigorous, multi-stage decoding pipeline designed to frustrate security analysts:

1. Base64 Decode: Unpacking the initial transport layer.
2. XOR Decryption: XOR'ing the data against a hardcoded key (STREAM_INIT).
3. Hex to Binary: Converting the resulting hexadecimal string.
4. Character Rotation: Applying a str_rot13 Caesar cipher.
5. Decompression: Expanding the payload via gzuncompress.
6. Execution: The fully unpacked payload is passed into a hidden @eval().

Actions on Objective & Remediation

Using the terminal emulator within their web shell, the attacker launched an interactive bash session directly on the server. Our analysis of the recovered .bash_history file revealed their exact movements.

They performed brief reconnaissance, verifying their user privileges and checking the filesystem for competing backdoors installed by other threat actors. Finally, they executed a destructive command to recursively delete the entire web root (rm -rf public_html/*), taking the client's site offline and replacing the homepage with a simplistic defacement message.