WP Botnet Master: How a Security Researcher’s Paid Course Built a 2.1-Million-Credential WordPress Botnet

On 13 July 2026, SOCRadar Researchers recovered the complete toolkit behind a distributed WordPress brute-force operation the operator called “WP Botnet Master.” We expected to be looking at the work of a single skilled attacker. What we found was a graduation project.

The server we pulled apart did not belong to a lone hacker. It belonged to a paying student of a structured, commercial “training” program run by a WordPress security researcher who sells cybercrime as a course – complete with a curriculum, a lab blueprint, a community, and an AI-assisted workflow that lets students build and run credential-harvesting botnets with almost no skill of their own. One student, acting alone, harvested 2,118,764 WordPress administrator credentials from 606,591 domains across 100 countries. There are roughly 295 more people in the community that trained him.

The botnet is a symptom. The academy is the disease.

Key Points

• A threat actor operating as “KING” (@Real_King_Engine) sells a paid course, the ISAL Framework, that teaches students to stand up attack infrastructure, generate exploits with commercial AI assistants, deploy web shells, and run a credential-harvesting botnet at internet scale.
• KING is a WPScan-credited vulnerability researcher with three published advisories and a Wordfence Intelligence researcher account carrying an approved bounty payout. These are real, verifiable identities – used as legal cover (“educational and defensive research only”) and as a credibility funnel to convert hobbyists into paying students.
• The recovered botnet server does not belong to KING. It belongs to one of his students, a self-published developer who identifies publicly as Saeful Rochim (“dalung,” github.com/dalungid), tied to the recovered toolkit by a confirmed code-authorship fingerprint match.
• The course teaches push-button, AI-assisted exploitation. In a paying student’s own words: “The system did everything automatically – I only drank soda.” Both Anthropic Claude and Google Gemini appear in the toolchain.
• The output SOCRadar recovered: 272 million sites scanned, 2,118,764 administrator credentials harvested across 606,591 domains in 100 countries, and 137 active web shells across 24 countries.
• As of the time of writing, the master command-and-control server (217.216.72.31) remained online and continued ingesting fresh target lists.

This is scalable, repeatable, and deliberately deniable cybercrime. Each of the ~295 community members is a candidate to reproduce the full operation – and an English-language edition of the course is already in development.

Attack Infrastructure

The recovered instance runs a clean hub-and-spoke architecture. A single master VPS coordinates a fleet of worker nodes over SSH, a Telegram bot provides the control plane, and GitHub serves as a resilient delivery channel for configuration and payloads.

The master node at 217.216.72.31 is the operation’s brain. Live reconnaissance on 15 July 2026 confirmed it hosting a Python SimpleHTTP/0.6 directory server on port 8082 (live), a worker result receiver on port 8899 exposing a public /result endpoint and directory listing (live), and SSH on port 22 for worker control via paramiko key authentication (live). The dedicated payload server on port 8081 – which had served the Ghost Protocol payloads, the malicious system-core plugin, and the cPanel token catcher – was down at the time of recon.

Redundancy is built into how the botnet phones home. Four parallel command-and-control channels keep it resilient: the Telegram Bot API as the primary control plane; GitHub Raw, where zeroxipinder/sonia hosts tengkurab.txt (the C2 base URL every worker fetches) and zeroxipinder/maharajadiningrat7898 hosts geturself.php (the shell payload); the port 8081 payload endpoints; and the port 8899 /result endpoint for real-time credential push. Take one channel down and the others keep the fleet running.

The worker fleet itself is more than 15 Ubuntu VPS nodes, each authenticated by RSA key and each running 500 threads. Seven form a static roster defined in vps_nodes.json; six more were provisioned dynamically for the large-scale operation, each chewing through roughly 45.3 million URLs in 760-800 MB chunks. Two further nodes were decommissioned mid-operation. (Full IP lists are in the Indicators of Compromise section below.)

Toolset Analysis

The core toolchain is bespoke – roughly 5,000 lines of Python 3 – and the surrounding clutter tells its own story: 19 separate fix_, patch_, test_, and debug_ iteration scripts, the fingerprints of rapid, hands-on development rather than a polished commercial product.

Bespoke components:

Four scripts carry the operation. nbrute_tg.py (2,003 lines) is the master Telegram C2 bot – SSH controller, load balancer, health checker, queue manager, and inline-keyboard menu all in one. nbrute_worker.py (695 lines) is the worker daemon, built around a ThreadPoolExecutor, with a CVE exploitation bridge, a four-method shell-upload routine, and HTTP result push back to the master. nbrute.py (1,367 lines) is a standalone command-line brute-forcer with a colorama interface, WordPress detection, and the five-layer credential engine. And remake_async.py (433 lines) is an async shell redeployer built on asyncio, aiohttp, and uvloop, capable of 10,000 concurrent connections.

The brute-force engine is smarter than a simple wordlist. It escalates through five prioritized layers, blending previously harvested credentials with statistically successful passwords and target-specific guesses generated on the fly. Layer 1 (highest priority) is a list of 600+ fixed credentials harvested from prior operations.

Layer 2 adds 100+ base credentials – admin/admin, admin/admin123, and other common defaults. Layer 3, which the author labels “Genius,” generates 18 patterns per discovered username (user123, user@123, user2026, reversed variants, pass+user, wp+user). Layer 4 derives 150+ domain-based variants from the site’s own name (domain+num, Domain+num, DOMAIN+num, domain+YEAR). Layer 5 falls back on proven passwords with high historical success rates (password2026, welcome123, qwerty123).

Before any of that runs, the engine identifies valid usernames. It enumerates authors through the classic GET /?author=1..10 redirect trick, queries the WordPress REST API at GET /wp-json/wp/v2/users, and scrapes HTML for comment-author-* patterns. Only then does it start guessing.

Not everything is homegrown. The operator assembled the toolkit from a mix of sources: the STEALTH FM V65 web shell (2,590 lines) was bought on an underground PHP market from an author known as “gyro”; the CVE-2025-15001 exploit (~1,300 lines) was pulled from an open-source GitHub project published on 6 January 2026; the Chankro LD_PRELOAD bypass came from a public GitHub technique; and standard PyPI libraries (curl_cffi, paramiko, aiohttp, uvloop) round out the stack.

Web Shell Analysis: STEALTH FM V65

The post-exploitation payload deserves its own section. STEALTH FM V65 is a 2,590-line commercial PHP web shell that packs a deceptive authentication gate, aggressive anti-forensics, six-method command execution, privilege-escalation chains, cPanel token theft, security-plugin sabotage, and a persistence system that survives complete file deletion.

Its front door is a fake. Visitors hit what looks like a plain 403 error page; the real login form is hidden and revealed only by pressing Tab, then gated behind a bcrypt hash and a cookie token. Automated access runs through an AJAX bypass keyed on custom X-Action, X-Tool, and X-Path headers. Once inside, the shell rewrites REMOTE_ADDR and every proxy header to 127.0.0.1, so the compromised server’s own logs show the attacker as localhost.

Command execution has six fallbacks in sequence – shell_exec, exec, passthru, system, popen, proc_open – so a single disabled function does not stop it. Where PHP restrictions bite, the shell escalates: a jailbreak module reads files through eight different binaries (cat, head, tail, awk, sed, tac, nl, dd), a symlink trick, and an open_basedir loop escape, while a dual-mode Chankro LD_PRELOAD routine bypasses disable_functions with an anti-recursion guard. To slip past ModSecurity, payloads are XOR-encrypted client-side with the key xilang and base64-encoded.

It also disables the defenses. Through direct MySQL writes, the shell renames Wordfence, iThemes Security, Sucuri, SG Security, and Limit-Login-Attempts plugin folders to *killed[timestamp], then steals a cPanel full-access API token (uapi Tokens create_full_access name=xilang) and creates a backdoor administrator (xilang / Wh0th3h3llAmi, tied to [email protected]) by writing straight to the user table.

The most dangerous property is persistence, and it comes in three independent layers. Layer 1 drops a plugin shell at wp-content/plugins/{8rand}/index.php; a ?gg=eh trigger copies it into the active theme and uploads directories through four separate deployment methods. Layer 2 installs a system-core plugin downloaded from C2 and auto-activates it by injecting the active_plugins MySQL option. Layer 3 – “Ghost Protocol” – is the one that defeats cleanup: three payloads are stored inside wp_options (transient_sys_pma_check, _cache_vx, _idx_core) as XOR-plus-gzdeflate blobs, then reconstructed and eval()-ed by a database-reading loader. Delete every file on disk and the backdoor rebuilds itself from the database.

On disk, the shell hides in plain sight. Six variants are deployed depending on delivery method and desired footprint (waf.php at 154 KB, the full 2,590-line waf-loader/index.php, a 207-line remote-include waf-security/index.php, a 70 KB index.php, a 20 KB index_stealth.php, and 38 KB waf_shell.php/x.php), and they masquerade as legitimate WordPress core files inside theme directories: class-wp-hook.php, class-wp-widget.php, class-wp-meta.php, class-wp-locale.php, class-wp-theme.php, and container-waf.php.

Exploitation: CVE-2025-15001

Brute force is only half the entry strategy. The platform also exploits CVE-2025-15001, an unauthenticated account takeover flaw in the FS Registration Password WordPress plugin (versions up to and including 1.0.1) that carries a CVSS score of 9.8. The vulnerability lets an unauthenticated attacker change any user’s password – including an administrator’s – and take over the account outright, which the toolkit then parlays into a shell upload.

The timing is the tell: The vulnerability was publicly disclosed on 6 January 2026, and the operator’s exploit module – a professional Python package with type hints, dataclasses, and unit tests – is dated the same day. A freshly published flaw was weaponized within 24 hours. Its six-stage chain runs from plugin detection through an exploitability score, user enumeration, reset-key injection, account takeover, and finally shell upload, integrated into the worker via cve_bridge.py. The professionalism of this exploit – tested, type-hinted, and explicitly AI-assisted – becomes significant once its origin is established below.

Credential Harvest Analysis

The operation’s primary product is a corpus of 2,118,764 harvested WordPress administrator credentials, spanning 606,591 unique domains and 682,372 unique user-and-password pairs. The single most common credential is the generic default admin:admin, seen on 10,548 sites. The most effective harvested credential – a strong, reused administrator password – is redacted from this public report.

Attribution

Everything above describes how the botnet works. But the recovered code did more than that – it revealed who built it. Two artifacts broke the case: recruitment links hard-coded into the botnet and its CVE exploit, which pointed to an instructor; and a code-authorship match between the botnet and a public GitHub account, which pointed to the operator who actually ran the server.

That distinction is the core finding. SOCRadar did not catch the teacher. We caught a student, and his own code led straight back to the classroom.

The recruitment banner: Both the botnet code and the bundled CVE-2025-15001 exploit hard-code a recruitment banner pointing to t.me/Real_King_Engine. The exploit literally prints a marketing pitch on execution: “STOP jadi Script Kiddie… Course WP Pentesting with AI.” A monetization funnel, embedded inside a working weapon. That Telegram profile links out to the @wpxploit community and the @ISAL_Framework course, and recovered course posts describe the exact tradecraft found in the toolkit. This is a HIGH-confidence link.

The fingerprint: The recovered server (master C2 217.216.72.31) is attributed at CONFIRMED authorship confidence to a student-operator who publishes under the handle “dalung.” SOCRadar established shared authorship between the operator’s public GitHub code (dalungid/rce/r1.py) and the recovered botnet (nbrute.py) through code-fingerprint analysis: both share the same distinctive colorama deconstruction, the identical Shells.txt output convention, the same Pool() threading pattern, matching SSL-warning suppression, and the same hard-coded operator Telegram channels. That match is corroborated by a direct GitHub fork link connecting the operator to the C2 organization (zeroxipinder/aw forked from dalungid/wa1).

The GitHub account github.com/dalungid (38 public repositories) self-identifies as Saeful Rochim, a self-described “Web Developer, Software Engineer, Editor,” corroborated across about.me/dalung, dalung.io, socialmast.xyz, fb.com/zxip47, and instagram.com/_dalung. His own code hard-codes the operator channel t.me/Priv8Leaks. Putting it together: a paying ISAL Framework student stood up real infrastructure, ran a 2.1-million-credential operation, and left his signature all over both the classroom and the crime scene.

• Individuals are presumed innocent pending due process. The code-to-server link is confirmed; the tie to a named individual rests on the operator’s own public self-identification and is provided for defensive and coordinated-disclosure purposes. Identifiers may be subject to revision.

The supporting cast rounds out a small organization: KING (@Real_King_Engine) as instructor, academy founder, and community manager, hiding behind the WPScan and Wordfence researcher cover; Saeful Rochim (“dalung”) as the graduate who deployed and ran the recovered instance; “gyro” as the third-party author of the STEALTH FM V65 shell; the zeroxipinder GitHub organization handling C2 configuration and payload delivery; and the 295 members of @wpxploit as a standing pool of potential operators.

Attribution Table:

One adjacent thread is worth flagging without overstating it. In the same underground Telegram market, SOCRadar observed a separate seller, “cliproot,” advertising a “Kurosaki” toolkit (“U.L.P Tools + Checker + Shell Hunter + Telegram Mode,” US$35) via t.me/cliproot and t.me/cliproots. The capability set closely parallels WP Botnet Master, but any direct relationship to KING is unconfirmed – assessed as a parallel offering in the same commodity market (LOW confidence in any direct link).

Modus Operandi: The Edu-Crime Academy

Following the Telegram links out of the toolkit’s own code did not lead to a lone operator. It opened onto an organized business.

KING runs a three-tier, vertically integrated Exploitation-as-a-Service operation on Telegram. At the top is the leader tier, @Real_King_Engine (“KING ENGINE”), presenting as a “WordPress Exploit Mentor” who has “guided 20+ hunters from zero to High-Impact CVE PoCs.” Beneath it sits the community tier, @wpxploit, a 295-member (54 online) Bahasa-Indonesia offensive-security group branded “Framework AI for Hacking” – the top of the marketing funnel and the recruitment pool for operators. And at the center is the product tier, @ISAL_Framework, a paid AI-assisted exploit-development course (currently Volume 4) with 129 subscribers and at least three confirmed paying students.

Legitimate Training vs. the Academy

Structurally, the “academy” maps almost one-to-one onto a legitimate security-training program – the difference is that every deliverable is criminal. Where a legitimate course offers a SANS, OSCP, or CEH certification, KING’s offers the WP Botnet Master toolset. Where a legitimate course provides a sandboxed virtual lab, KING’s has students stand up a real, internet-exposed server on Google Cloud. Theoretical instruction is replaced by live CVE exploitation and credential harvesting; the capstone project is “break your first 1,000 WordPress sites”; job-placement support becomes underground-market connections; and the “certified professional” at the front of the room is a WPScan-credited botnet operator.

The Curriculum: ISAL Framework

The revenue and capability engine is the ISAL Framework course, marketed as a “Pre-0day Autonomous Engine” that validates CVEs and hunts zero-days while “eliminating AI hallucinations.” Recovered posts describe a structured, tool-assisted pipeline. Volume 4 is billed as a full refactor of prior versions, delivered in 6 hours 30 minutes across three AI-enabled IDEs. It teaches an auto-classification severity model that promotes Tier-1 findings (SQL injection, RCE, object injection, file upload and inclusion, privilege escalation, authentication manipulation, Phar deserialization) and auto-discards low-severity Tier-2 results (XSS, SSRF, settings tampering, variable overwrite). The prescribed lab is a GCP e2-medium instance (2 vCPU / 4 GB) running Apache, MySQL, PHP 8.1, WordPress, nip.io, Let’s Encrypt via Certbot, and HTTP Basic Auth. The toolchain combines ProjectDiscovery’s nuclei and httpx, BurpSuite or Caido, LocalWP, Node.js, Go – and AI coding assistants, with Claude and Gemini both named. Its demonstrated cases walk students through account takeover and arbitrary file upload leading to RCE via ZIP upload and plugin activation.

The classroom is the operation: Each lesson teaches a discrete offensive capability that appears, verbatim, inside the recovered toolkit. Lesson 1 (stand up a WordPress server on GCP) becomes the attacker’s disposable-lab tradecraft. Lesson 2 (scan with nuclei and httpx) becomes internet-scale reconnaissance across 6.46 billion domains and 272 million sites. Lesson 3 (generate exploit code with an AI assistant) becomes the AI-assisted CVE-2025-15001 exploit chain. Lesson 4 (upload a shell, kill the security plugin) becomes STEALTH FM V65 deployment and Wordfence/Sucuri disabling. Lesson 5 (persistent backdoor with “Ghost Protocol”) becomes the database-resident persistence described above. Lesson 6 (steal the cPanel token, move laterally) becomes full-access API-token theft and hosting-account takeover. The homework – “run the botnet, collect credentials” – produced 2,118,764 credentials, 606,591 domains, and 137 live shells.

The AI Assembly Line

The course’s central promise is automation. Students drive commercial AI coding assistants to auto-generate and validate exploit code, then run it hands-off. A private onboarding chat with a paying Turkish student captures the model exactly: the instructor teaches using Gemini to build the lab, and the student confirms the pipeline runs itself. His words – “The system did everything automatically – I only drank soda” – are the whole business plan in one sentence.

One marketing claim warrants a caveat. The ISAL Framework’s promotional material states the pipeline was “designed by advanced AI architecture Fable 5 / Mythos (Anthropic),” described as a “super-intelligence system now shut down by the US Government.” SOCRadar assesses the “shut-down super-intelligence” framing as marketing embellishment with no supporting evidence. The underlying behavior, however – using commercial large-language-model coding assistants (Anthropic Claude and Google Gemini are both referenced) to generate and validate WordPress exploit code – is credible, corroborated by the course toolchain and the student chat, and warrants notification to the named AI vendors’ trust-and-safety teams.

The Researcher Mask: Dual Identity as Cover

KING’s credibility is genuine, and that is precisely what makes it dangerous. He is credited with three WordPress vulnerability advisories on WPScan and maintains a Wordfence Intelligence researcher account under the same handle, with an approved bounty payout. These real footprints in the legitimate ecosystem are weaponized in five ways.

They provide legal cover: all course material is labeled “STRICTLY FOR EDUCATIONAL AND DEFENSIVE RESEARCH ONLY,” supporting a plausible-deniability defense. They lend credibility that converts hobbyists into paying customers. They confer an early-warning advantage, since vulnerability-disclosure workflows surface unpatched plugins ahead of the wider criminal market. They enable deniability – “I only provide training; I’m not responsible for what students do.” And they feed the operator pipeline, turning a 295-member community into a recruitment pool.

Why the Academy Model Is Dangerous

This operation is scalable (teaching turns one operator into many, and an English edition targets a worldwide market), repeatable (a documented, AI-assisted curriculum reproduces the full kill chain without deep skill), deniable (a genuine researcher badge and “educational” framing provide legal and platform-moderation cover), and self-financing (course sales fund infrastructure while harvested credentials fund the next cohort). SOCRadar assesses KING as a professional, vertically integrated cybercrime enterprise, not a lone operator.

Scalability

The danger is best understood by projection. A single identified student, working alone, produced the entire observed impact of 2.1 million credentials across 606,591 domains. The community that trains such operators has 295 members, and the course hands each of them a reusable VPS blueprint. If just 10% of the community deployed, that scales to roughly 60 million credentials; the full community operating at single-student scale reaches 600 million or more. Those figures above the observed 2.1 million are projections rather than confirmed totals, offered only to convey the model’s scalability – but with an English-language edition in development, global expansion of this operator pool is assessed as imminent.

Victimology

Victims span 100 countries. By harvested-credential volume, Brazil (75,477), India (54,298), and the United Kingdom (39,201) lead, while Indonesia (27,943) reflects the operator’s home region.

Of the campaign, 137 web shells remain active across 24 countries – confirmed, fully compromised sites under active operator control – with the largest concentrations in Vietnam (23) and Iran (8).

Technology dominates by sector, but the exposure reaches well into critical infrastructure: Government accounts for 53,856 credentials, Education 34,684, Healthcare 22,810, and Finance 11,826.

Campaign Timeline

The operation moved from tooling to internet-scale exploitation with striking speed – the version 1 to version 3 rewrite happened inside a single 24-hour window, and internet-scale data collection followed within days.

Detection and Response

Immediate Actions

• Rotate all WordPress administrator credentials; ban weak, reused, and pattern-based passwords; enforce MFA on wp-admin.
• Patch or remove FS Registration Password ≤ 1.0.1 (CVE-2025-15001); audit all plugins for known-vulnerable versions.
• Block the master C2 (217.216.72.31) and all worker IPs; block outbound to the Telegram bot token and the two GitHub payload repos.

Hunt & Detect

• Inspect wp_options for the three Ghost Protocol transients and active_plugins for system-core; search the user table for xilang.
• Alert on author-ID/REST user enumeration, high-rate wp-login.php POSTs, plugin uploads to update.php, and ?gg=eh requests.
• Detect security-plugin folders renamed to *_killed_[timestamp] and files masquerading as WP core classes in theme directories.

Respond

• File cleanup alone is insufficient – remove the Ghost Protocol transients, the system-core plugin, and the xilang account, then rotate all credentials and secrets.
• Where compromise is confirmed, rebuild from known-good backups predating first shell deployment (≥ 3 July 2026) and rotate hosting/cPanel API tokens.
• Treat all harvested credentials as burned – reset and monitor for credential-stuffing reuse across other services.

Indicators of Compromise

Ecosystem and Network Indicators

Host Indicators

Behavioral Indicators

MITRE ATT&CK Mapping

Tooling and Components

Dual-use tooling taught by the course and used to build the operation (legitimate software, not indicators in themselves): nuclei and httpx (ProjectDiscovery), BurpSuite or Caido, LocalWP, Node.js, Go, and the AI coding assistants Anthropic Claude and Google Gemini.

A Note on Sourcing

All figures, statistics, and indicators in this analysis derive from the operator’s own recovered toolkit – source code, target lists, harvested-credential files, SSH keys, and operational logs – captured on 13 July 2026 and validated against live C2 reconnaissance on 15 July 2026, supplemented by open-source intelligence on the KING ecosystem and the operator’s public profiles. Individual-operator attribution (“dalung”) is provided at moderate confidence and may be subject to revision; victim-identifying data has been redacted.

You can contact us at [email protected] for the full analysis report.