Exposed server reveals crew that backdoored thousands of WordPress sites for resale

A cybercrime group left its own server exposed on the internet for weeks, revealing a mass website-hacking operation that researchers at SOCRadar now track as WP-SHELLSTORM. The crew breaks into sites at scale, plants hidden backdoors, and resells the access to other criminals. Rather than using zero-days, it automated attacks against 27 known vulnerabilities in outdated WordPress and Joomla plugins; a single flaw in the Breeze caching plugin accounted for over 17,000 backdoored sites. Target lists named more than 1.4 million domains, with roughly 25,000 confirmed compromised. The same server also revealed an earlier campaign that stole cloud credentials and database passwords from exposed configuration servers.

Check

Update WordPress and Joomla plugins, especially the Breeze caching plugin and Joomla's JCE editor, and hunt for webshells with suspicious names and fake kernel-worker processes that indicate a backdoor.

Affected

Organizations running WordPress or Joomla sites with outdated, vulnerable plugins; the crew automatically exploits known flaws to plant backdoors, then sells that access, making even low-profile sites worthwhile footholds.

Fix

Keep plugins patched on a regular cadence, put a web application firewall in front of anything you cannot patch immediately, scan for known webshell indicators, and rotate credentials on exposed configuration servers.