Do Son 
At a Glance
| Attribute | Details |
|---|---|
| Malware Family | Unnamed WordPress Must-Use Plugin Malware (EtherHiding variant) |
| Threat Actor | Unknown (unconfirmed attribution) |
| Target Victims | WordPress websites, particularly e-commerce sites running WooCommerce |
| Delivery Vector | Direct filesystem placement via compromised administrative credentials or web flaws |
| Key Capabilities | EtherHiding blockchain C2, self-healing, password harvesting, dashboard cloaking |
| Source | The Wordfence Threat Intelligence Team |
Executive Summary
Security researchers at Wordfence identified a persistent backdoor deployed as a must-use plugin across thousands of websites. The implant uses Ethereum smart contracts as decentralized resolvers to conceal its remote management infrastructure. Furthermore, the malware contains aggressive self-repair routines that automatically reinstall deleted code.
Delivery Tactics
The exact initial intrusion vector remains unconfirmed across investigated victim sites. However, attackers typically gain entry by exploiting known web software vulnerabilities or compromised administrative credentials. Once attackers obtain filesystem access, they place a malicious PHP file into the mu-plugins directory.
The threat actors alter file names and metadata across different intrusions to defeat basic file matches. According to Wordfence, “Across our detections, samples appeared under more than 4,000 distinct filenames.” Attackers frequently mimic common WordPress drop-in files like advanced-cache.php and db.php. In addition, the operators forge plugin names, author identities, and repository URLs. Therefore, site owners cannot identify the threat solely through standard file names.
Infection Chain Architecture
Must-use plugins occupy a unique position inside the WordPress ecosystem. Wordfence explained that “Must-use plugins load automatically on every WordPress request and cannot be deactivated from the standard Plugins screen.” Consequently, the backdoor runs automatically without requiring manual activation by an administrator.
Custom Obfuscation and Concealment
The malware uses a custom substitution cipher to evade static detection rules. Instead of using standard base64 decoding functions, it maps characters between two custom alphabets. The script decodes sensitive function names, database keys, and filesystem paths only when executing them. Furthermore, the malware replaces specific SQL keywords with hexadecimal sequences. This approach conceals database queries from standard web application firewalls.
Next, the code actively hides itself from the WordPress administrative dashboard. It registers custom WordPress filter hooks to remove itself from plugin lists. The script also removes update warnings and suppresses health diagnostic alerts.
Rogue Accounts and Self-Healing
To secure permanent control, the malware generates rogue administrative accounts. It combines common prefixes like “admin_” with random characters to form unique usernames. Then, it hooks database user queries to hide these accounts from the Users screen. The script even adjusts displayed user totals so administrators notice no numerical discrepancies. In addition, it hooks authentication filters to capture legitimate administrator passwords in plaintext during login.
The malware also deploys multiple self-healing mechanisms. An hourly scheduled check reads a clean copy of the malicious script stored inside the database. If someone modifies or deletes the file, the routine writes the code back to disk. Afterwards, it backdates file timestamps to blend with older system files. Moreover, the malware scans surrounding web directories every three days to infect neighboring sites on shared hosting servers.
Command-and-Control and Data Exfiltration
The communication architecture represents a notable evolution in web threat infrastructure. Rather than hardcoding fixed server domains, the backdoor applies a technique called EtherHiding. Security firm Guardio first documented EtherHiding in late 2023 when analyzing decentralized web attacks. By retrieving configuration data from smart contracts, attackers prevent defenders from disabling command channels.
During runtime, the malware selects an Ethereum smart contract and a public blockchain gateway at random. It sends a read-only request to query the contract method. The returned hex data decrypts into an encryption key and a list of active control servers. Wordfence observed that “Nearly every component of this malware aims to either avoid detection or survive removal attempts.” This resilience helps the implant achieve its primary goal of exfiltrating sensitive data.
After obtaining operational server addresses, the malware submits a structured intelligence report. This payload contains administrator credentials, active session cookies, and database paths. Furthermore, it searches configuration files and WooCommerce tables for payment gateway keys. The malware targets providers such as Stripe, Braintree, Authorize.Net, and Amazon Web Services.
In response, the remote server issues commands that update the malware or modify the website. The server can push regular expression rules to delete security plugins or strip code from active extensions. Finally, the server can deliver malicious JavaScript to inject into the website footer for all visitors.
Attribution Analysis
Wordfence researchers treat the attribution of this threat actor as unconfirmed. The operators avoid leaving clear attribution markers within the codebase. However, the reliance on decentralized smart contracts points to an organized group focused on payment card theft.
Defense and Detection Guidance
Site owners must take immediate precautions to defend against this WordPress must-use plugin malware. Because the malware hides from the dashboard, administrators must inspect the wp-content/mu-plugins directory using command-line tools or SFTP. Search for unfamiliar PHP files containing complex string-lookup arrays.
Additionally, administrators should query the wp_users database table directly. Look for hidden accounts created with common administrator prefixes. Security teams must also search the wp_options table for suspicious entries like src, bu, bp, and ic.
If an infection occurs, defenders must clean both the filesystem and the database simultaneously. Deleting the file alone will trigger the self-healing routine to recreate it. For technical indicators and analysis, review the Wordfence analysis of the malicious must-use plugin. Site owners should also rotate all database passwords, administrator credentials, and third-party payment API keys immediately.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
