Chinese Hacker Fails Big: Dumb Mistake Exposes Tools and 25k Backdoors, logs and target's list

Yo, you won't believe how stupid these hackers were. So, there's this Chinese cybercrime crew running a massive operation called WP-SHELLSTORM, right? They were using automated bots to scan the web and hack thousands of WordPress and Joomla sites using old, unpatched bugs. But get this—the guy running the show literally started a basic Python web server to move his files around and forgot to turn it off. He left their entire command server wide open to the internet for three whole weeks.

Security researchers just walked right in and found everything. We are talking exploit scripts, logs, and a target list with over one million sites. While the headlines scream about millions of targets, they actually only managed to compromise around twenty-five thousand sites. Still a lot, but context is everything. Their favorite target was a flaw in the Breeze caching plugin, which let them plant hidden backdoors on seventeen thousand sites all by itself. And before this WordPress spree, they secretly hit big corporate Java systems running Nacos, running away with AWS and Alibaba Cloud keys from fintech and logistics companies. Talk about a payday.

If you are running WordPress or Joomla, you seriously need to patch your stuff right now. Update the Breeze plugin and the Joomla JCE editor immediately because these guys, and plenty of others, are actively hunting for them. Check your server directories for shady files ending in dot bd dot php or dot wp-log dot php. Also, keep an eye on your Linux processes because these threat actors were hiding their backdoor under the name kworker to blend in with the system. If your kworker process is hitting the network, you are compromised. It just goes to show you do not need to be a genius to hack thousands of sites, you just need lazy admins who forget to update their plugins.