A UK charity's WordPress website went down with an error, and stayed down. The site had been hacked weeks earlier, and it was the hacker's own tools that finally broke it.
Four years without an update
The site was running a version of WordPress from early 2022, with most of its 39 plugins years out of date. Automatic core updates had been switched off in its configuration, and a plugin conflict had stopped anyone updating it by hand. For a long time nothing went wrong, which is exactly how sites end up in this state.
Sites like this are found by automated tools that do nothing but scan the internet for old software. In early August one of them found this site. The first thing the attacker did was write a single tiny file containing a six-digit number, then fetch it back. That is a test: if the number comes back, the attacker knows they can write files to the server. Everything else followed from there.
What was on the server
By the time we looked, about three weeks later, the attacker had built a lot of ways back in:
- Nine webshells, small files that let anyone who knows the password run commands on the server through a web browser. Each one had a different password, so finding one would not give away the others
- A remote-control loader disguised as an audio file. It only ran instructions that were digitally signed and carried an expiry time, and it fetched the actual code from elsewhere each time, so nothing it did was left on the server
- A fake plugin that copied real, abandoned plugin code as camouflage, with one extra line that rewrote a backdoor into the site on every page load. Delete the backdoor, and the next visitor put it back
