Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
A cybercrime crew left its server exposed for three weeks, revealing the inner workings of a mass site-hacking operation tracked as WP-SHELLSTORM.…
Tag: VShell
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
A suspected China-aligned threat activity cluster tracked as UNK_MassTraction by Proofpoint has been exploiting critical Roundcube webmail vulnerabilities to target physics and…
UNK_MassTraction: China-Aligned Threat Cluster Exploiting Roundcube
UNK_MassTraction is a suspected China-aligned threat activity cluster first detected by Proofpoint in May 2026. It targets physics and engineering departments at…
UNC5174: Suspected Chinese State Group
A suspected Chinese state group linked by Sysdig to the SNOWLIGHT-to-VShell toolchain in April 2025. The same tools were used by WP-SHELLSTORM,…
VShell: Stealthy Backdoor
A stealthy backdoor that disguises its process name as [kworker/0:2] to blend in with kernel threads. Used by WP-SHELLSTORM for remote access,…
SNOWLIGHT: Dropper Malware
A dropper used by WP-SHELLSTORM to install the VShell backdoor. Previously linked to UNC5174 by Sysdig in April 2025.
Sysdig: Security Company
A security company that linked the SNOWLIGHT-to-VShell toolchain to UNC5174 in April 2025.