Server Mistake Exposes StopAndProtect’s Hacked WordPress Network

1. Executive summary

Check Point Research reports a malware operation labelled StopAndProtect that used compromised WordPress sites to present fake CAPTCHA prompts, distribute malware, issue commands and store victim logs. Its recovered files reportedly listed close to 2,000 compromised WordPress domains; successful ClickFix execution led through PowerShell and in-memory .NET stages to credential theft, file exfiltration, SMB/USB propagation, screen locking and selective ransomware deployment. For EMEA financial-services organisations, the principal risks are employee infection while browsing compromised sites and abuse of vulnerable WordPress estates, rather than confirmed sector-specific targeting. No specific CVE, CVSS score, severity or CISA KEV state is present in the verified reference data, and the method used to compromise the WordPress sites remains unknown. StopAndProtect attribution is unconfirmed because it has no MITRE ATT&CK profile; the technical reporting is single-sourced to Check Point and should be verified before enforcement.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The following sequence is confirmed within Check Point Research’s technical report, but is not independently corroborated by the supplied material:

1. Malicious infrastructure: Operators used compromised WordPress sites to host malware stages, act as base command-and-control servers, deliver instructions and store victim telemetry and exfiltrated logs. The original WordPress compromise mechanism was not established.
2. ClickFix execution: Visitors to affected sites received a fake CAPTCHA prompt instructing them to execute a PowerShell command. The exact command is not available in the source.
3. First PowerShell stage: The initial script submitted an execution log to the base C2 server, downloaded a second PowerShell stage and executed it.
4. In-memory .NET loading: The second PowerShell stage downloaded a base64-encoded .NET assembly, decoded it and loaded it directly into memory. It enumerated assembly types and their methods, locating a method named Execute that was static and accepted no parameters, then instantiated the corresponding type and invoked that method.
5. Loader progression: The .NET stage-one loader launched a second-stage downloader and loader. At least one stage retrieved its next component through a dwnen.php endpoint on compromised WordPress infrastructure.
6. Modular payload deployment: The third stage could deploy an encryptor/ransomware component, SMB/USB worm, lockscreen, credential stealer, VBS spreader and chat utility. Ransomware was not deployed to every victim.
7. Collection and impact: Malware stages collected telemetry and uploaded execution logs. Operators silently exfiltrated file listings and subsequently selected files from some systems; downloaded instructions determined which machines to encrypt and which files to steal.

Infrastructure exposure

A PHP script exposed a directory listing on attacker-controlled infrastructure. Querying the reported dwnen.php endpoint without parameters returned a file listing; Check Point could list directories and download files other than .php files.

Check Point also recovered an archive it suspects resulted from an operator infecting their own system. It reportedly contained source code for an automation tool used to manage injected payloads across compromised WordPress sites and text files listing close to 2,000 domains. The suspected self-infection and the resulting estimate of campaign scale are single-sourced and not independently confirmed.

WordPress exposure

One sampled compromised site reportedly ran a WordPress version from 2021. A scan found nearly 40 potential issues, including expired certificates, SQL injection, open redirects, authentication bypasses and authenticated arbitrary-file-upload weaknesses. No individual CVEs or affected plugin versions were disclosed, and the report did not establish which—if any—of those weaknesses provided initial access. Consequently, no CVE-specific remediation or CISA KEV prioritisation is supportable.

Capability gaps

The supplied material provides no persistence mechanism, privilege-escalation method, encryption implementation, ransom-note text, lateral-movement procedure, exact PowerShell command, malware filename, hash, C2 domain, IP address, port or transport protocol. The presence of SMB/USB and VBS spreading components establishes propagation capability, but not their detailed mechanics or successful execution on any named victim.

4. Mitigation & containment

P1 — within 24 hours

• Isolate endpoints showing the ClickFix sequence, suspicious user-initiated PowerShell execution, in-memory .NET loading, credential-stealer activity, unexpected encryption or SMB/USB propagation. Preserve memory and EDR telemetry because the first .NET assembly is loaded in memory.
• Search proxy and web telemetry for requests containing dwnen.php. Correlate hits with PowerShell activity and compromised WordPress destinations; the endpoint name is single-sourced and low-specificity, so verify before blocking.
• For confirmed infections, terminate malicious PowerShell activity, disconnect removable media and temporarily restrict unnecessary SMB communication from affected systems.
• Revoke active sessions and rotate exposed user, administrator and service credentials from a clean system. Assume credentials handled on an infected endpoint may have been collected.
• If an organisation-controlled WordPress site displays the fake CAPTCHA or serves injected payloads, remove it from service, preserve web-server/content-management logs and stop it delivering content or receiving victim uploads.

P2 — within 72 hours

• Hunt across PowerShell, EDR, proxy and application telemetry for the reported sequence: PowerShell execution, secondary PowerShell retrieval, base64-encoded .NET content, in-memory assembly loading and subsequent network access to WordPress hosts.
• Inventory public WordPress core and plugin versions, including supplier-managed sites. Prioritise unsupported or materially outdated deployments, but do not treat the report’s unnamed 2021 installation as a universal affected version.
• Update WordPress core and installed plugins to current vendor-supported releases obtained through trusted channels. No campaign-specific fixed version or CVE is available.
• Compare WordPress application files and database content with known-good baselines. Investigate injected CAPTCHA content, unknown PHP handlers, unexpected payload archives, writable content and exposed directory listings.
• Review affected systems for file enumeration, unusual bulk reads, outbound log uploads, credential access, encryption and propagation through SMB or removable media.

P3 — within seven days

• Rebuild compromised WordPress instances from known-good media where integrity cannot be established. Rotate CMS administrator, hosting, database and deployment credentials.
• Restrict PowerShell to authorised administrative use where operationally feasible and ensure PowerShell, endpoint and network telemetry is retained for investigation.
• Reinforce user guidance that CAPTCHA or browser prompts must never require pasting or executing PowerShell commands.
• Test restoration of business-critical data and endpoint builds against the reported selective-encryption risk.
• Review whether removable-media controls and SMB segmentation prevent a compromised workstation from reaching unnecessary systems.

5. Indicators of compromise

uri-path  dwnen.php

No hashes, domains or IP addresses are present in the supplied source material.

Behavioural indicators

6. Detection

The following YARA rule identifies files containing the reported endpoint name. It is intentionally narrow but low-specificity and must be correlated with execution or network evidence.

rule StopAndProtect_Downloader_Endpoint_Reference
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-19"
        reference = "https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/"
        description = "Detects the reported StopAndProtect next-stage endpoint name; single-sourced and low-specificity."

    strings:
        $endpoint = "dwnen.php" ascii wide

    condition:
        $endpoint
}

title: StopAndProtect Request to Reported dwnen.php Endpoint
status: experimental
description: Detects proxy traffic containing the next-stage endpoint reported by Check Point Research.
author: Adverse Trace
date: 2026-08-19
references:

  - https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/
logsource:
  category: proxy
detection:
  selection:
    url|contains: 'dwnen.php'
  condition: selection
falsepositives:

  - Unrelated web applications using the same endpoint filename
level: medium

The source does not provide the PowerShell command, loader filenames, domains or hashes required for higher-confidence command-line or payload rules.

7. Sources

• Check Point Research, “Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect,” 2026; exact publication date not supplied.
• DataBreaches.net, “Server Mistake Exposes StopAndProtect’s Hacked WordPress Network,” 2026-08-19.

8. Adverse Trace position

Adverse Trace does not assign a CVSS-based severity or exploitation rating because the verified data identifies no specific CVE, CVSS score or CISA KEV state. Confirmed infection warrants P1 response due to the reported credential theft, file exfiltration, SMB/USB propagation, lockscreen and selective-encryption capabilities; general client exposure remains conditional because no EMEA financial-services targeting or client compromise is reported. StopAndProtect attribution is unconfirmed: it is Check Point’s operation label and has no MITRE ATT&CK profile. The technical evidence and IOC are single-sourced; clients should verify before enforcement, while Adverse Trace monitors for independent corroboration, validated infrastructure indicators and disclosure of the WordPress initial-access mechanism.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.