Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites

A cybercrime crew left its server exposed for three weeks, revealing the inner workings of a mass site-hacking operation tracked as WP-SHELLSTORM. The operation, a webshell access brokerage, broke into websites at scale, planted hidden backdoors, and packaged access for resale. The strongest activity targeted WordPress sites running outdated plugins, particularly the Breeze caching plugin and Joomla’s JCE editor.

Two research teams, SOCRadar and Ctrl-Alt-Intel, analyzed the exposed server at 137.175.93[.]126, finding 800MB of data including webshells, exploit scripts, scan results, and command history. The crew used publicly known bugs in website plugins, mostly WordPress, and built automated scanners to exploit massive target lists from FOFA, a Chinese search engine. The toolkit covered 27 known flaws, with the Breeze caching plugin bug (CVE-2026-3844) being the most productive, backdooring over 17,000 sites.

The main backdoor, down.php, was heavily obfuscated and derived from BestShell. The crew used a SNOWLIGHT dropper to install VShell, a stealthy backdoor that disguises its process name as [kworker/0:2]. The server also held traces of an earlier campaign against corporate Java systems, targeting Nacos (CVE-2021-29441) and stealing cloud login keys and database passwords.

Both teams assess with medium-to-high confidence that the operator is Chinese or Chinese-speaking, citing fluent Simplified Chinese, reliance on FOFA, and tooling favored in Chinese-speaking forums. The crew was careless, leaving the server open and a FOFA config file traceable through law enforcement. The exposure lasted 22 days before the operator noticed and deleted log lines.

To mitigate, patch Breeze (CVE-2026-3844, fixed in 2.4.5) if the non-default setting is on, and treat the Joomla JCE flaw (CVE-2026-48907) as urgent. Check for other vulnerabilities like ThemeREX Addons, Simple File List, and Nacos. Hunt for webshell filename patterns and block known infrastructure IPs and domains.