WP-SHELLSTORM - WordPress Mass Exploitation Operation
Indicators of Compromise
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
MITRE ATT&CK mapping for the WP-SHELLSTORM kill chain, from FOFA-driven reconnaissance through persistent, disguised VShell implantation, and the parallel Nacos/XXL-Job/Spring Boot intrusion branch.
Technique ID | Technique Name | Detection ID | Detection Name | Recommended Detection Action |
T1596 | Search Open Technical Databases (FOFA/Shodan Recon) | D-01 | Mass reconnaissance sweep of CMS fingerprints | Baseline and alert on unusually broad, low-interaction scanning traffic hitting version-fingerprint endpoints (wp-json, readme.html, /administrator/manifests) at scale. |
T1190 | Exploit Public-Facing Application | D-02 | Weaponized CVE exploitation across CMS plugins | Deploy virtual patching / WAF rules for the 27 listed CVEs; alert on POST requests to plugin upload/import endpoints outside admin sessions. |
T1505.003 | Server Software Component: Web Shell | D-03 | Webshell filename/pattern upload | File-integrity monitoring on web roots for the filename patterns and directory paths listed in Mitigation; alert on any new .php file in cache/upload directories. |
T1071.001 | Application Layer Protocol: Web Protocols | D-04 | SNOWLIGHT stager / VShell WebSocket C2 | Inspect outbound WebSocket upgrades to unfamiliar domains from web-server hosts; flag connections to xs.xxooonline.eu.cc or its resolved IPs. |
T1036.004 | Masquerading: Masquerade Task or Service | D-05 | VShell implant disguised as kworker | Run the process-anomaly check (ps aux | grep kworker, verify /proc/{pid}/exe) on all Linux hosts; alert on any kworker-named process resolving to a non-kernel binary path. |
T1583.001/.004 | Acquire Infrastructure: Domains/Server | D-06 | Disposable subdomain / staging server use | Flag DNS resolutions to free/disposable subdomain providers (e.g., eu.cc) combined with newly observed hosting ASNs. |
T1136 | Create Account | D-07 | Unauthorized webshell-based account/user creation | Monitor CMS admin-user creation events outside change windows correlated with webshell file-access logs. |
T1210 | Exploitation of Remote Services | D-08 | Apache Nacos authentication bypass (CVE-2021-29441) | Alert on GET /nacos/v1/cs/configs and GET /nacos/v1/auth/users requests carrying User-Agent: Nacos-Server from non-internal sources. |
T1210 | Exploitation of Remote Services | D-09 | XXL-Job unauthenticated RCE | Monitor XXL-Job admin panel exposure; alert on repeated POST /xxl-job-admin/login attempts with iterating password values (brute force). |
T1552.005 | Unsecured Credentials: Cloud Instance Metadata / App Config | D-10 | Spring Boot Actuator heap-dump credential theft | Alert on GET /actuator/heapdump, /actuator/env, and /actuator/beans from external sources; disable these endpoints in production. |
T1210 / T1570 | Lateral Movement via Nacos-to-XXL-Job Trust | D-11 | Config-server pivot to executor RCE | Segment Nacos config servers from XXL-Job executor networks; alert on new executor registrations following a Nacos compromise indicator. |
T1560 / T1041 | Archive / Exfiltrate Collected Data | D-12 | Bulk configuration file / archive exfiltration | Alert on large outbound transfers of .tar.gz/.zip archives from configuration-management hosts to unfamiliar external IPs. |
T1070.002 | Indicator Removal: Clear Linux/Mac System Logs | D-13 | Operator self-deletion of server logs post-exposure | Monitor for gaps or truncation in httpd/access logs and bash history immediately following unusual inbound access from research/monitoring IP ranges. |