Skimmers and other threat actors are backdooring websites, and WordPress instances in particular, according to a recently released report. Researchers at [Sucuri say]() attackers have developed methods to make sure that their grip on the infected site is not easily removed by applying the next update. They create a backdoor for themselves so they can easily take back control and insert their own code. ## WordPress as a target WordPress, the most popular web content management system (CMS), has seen its fair share of [plugins that leave online shoppers vulnerable](). One common mistake website owners often make is to leave their CMS unpatched thinking they are not an interesting target. In many cases, users may choose not to apply security updates for fear of introducing bugs or even stop a website from loading properly. This behavior creates the perfect opportunity for online criminals to exploit known vulnerabilities on a large scale. However, the research by Sucuri shows that even site owners that patch promptly are not safe from certain threat actors. ## Creating a backdoor To make sure they can stay inside the site once they're in, the threat actors create a backdoor that either re-inserts the malicious code or allows the threat actor access to do it manually. Attackers have developed different methods for protecting their work. In most cases of this type of infection, we will find a modified _index.php _which in some cases automatically regenerates itself through a malicious process running in the background. The persistent, running processes on the server are what allows the malware to automatically and immediately reinfect the site once the infection is removed. Even on non-WordPress sites the attackers will replace _index.php_ with an infected copy of the WordPress _index.php_ file. In other cases, the researchers found hundreds or sometimes thousands of infected _.htaccess_ files scattered throughout the website directories. These are designed to prevent custom PHP files or tools from running on the site in case there’s mitigation already in place. In other cases you may find a modified _wp-includes/plugin.php_ file designed to re-create the _index.php_ and _.htaccess_. But even though _plugin.php_ is a common point of attack, similar code has been found in other core files. ## Identifying and cleaning the problem Malicious code on your website can be planted there for various reasons, such as for card skimming or spreading malware. To keep an eye on your site, the following areas are important: * File integrity, make sure that your core files can’t be changed without you being aware of the changes. One option to do this is file integrity monitoring through active server-side scanners. * Logging. All important changes on your site should be visible in logs. New plugins, updates of the CMS and plugins, and file changes should be monitored. If you do not recognize them as something you implemented, then investigate them. This [Sucuri b]()[l]()[og]() has elaborate instructions on how to remove these infections, should you find your site has fallen victim to these threat actors. ## Protecting your site For website owners there are some guidelines to stay safe from these practices. * Put your website behind a firewall. Or take other measures that restrict access to the wp-admin area to only specific IP addresses. * Regularly change all admin passwords associated with your site. This includes the admin dashboard, CPanel/FTP, ssh and email. Where possible enable [MFA](). * Keep all plugins, themes and your CMS up to date at all times and remove any unneeded plugins or themes. Speed is important. Attackers are always aware of the latest vulnerabilities and will scan the Internet for unpatched sites to hijack, sometimes within hours of a patch being made available. You can read more in our article: [How to defend your website against card skimmers](). For visitors of shopping sites, take as many precautions as possible. There are [browsers and browser configurations]() that will help you against falling victim to skimmers, malicious redirects, and other unwelcome code on a site you are visiting. Stay safe, everyone! The post [Has your WordPress site been backdoored by a skimmer?]() appeared first on [Malwarebytes Labs]().

Query Builder