Dissecting a WordPress Brute Force Attack

WordPress Brute Force attack

Over the past few months there has been a lot of discussion about WordPress Brute Force attacks. With that discussion has come a lot of speculation as well. What are they doing? Is it a giant WordPress botnet? Is it going to destroy the internet? Well, as you would expect of any good geeks we set out to find a way to find out.

This is not to be exhaustive case study or meant to be a representative sample of what all attacks look like, but it does have similar characteristics to the types of attacks and infections we deal with on a daily basis.

In this post, my goal is to highlight a hack that occurred this weekend, July 20th to be exact, against one of our several honeypots. In this specific instance, it was setup and configured approximately 2 months ago. It had been hacked about a month and a half ago and silly me I forgot to configure what I needed to do real forensics, oops. In any event, everything was cleared and pushed out again to see what happened, it was nothing more than a matter of sitting back and waiting.

Dissecting a WordPress Brute Force Attack | Sucuri Blog

Dropbox, WordPress used as cloud cover in new APT attacks

The cyberespionage gang out of China who recently hacked into media outlet networks is now using Dropbox and WordPress in its attacks rather than via traditional email phishing attacks and server compromise, new research has found.

WordPress used as cloud cover in new APT attacks

Dropbox used as cloud cover in new APT attacks

The so-called DNSCalc gang, which breached The New York Times during the fall of 2012 and again in early 2013, appears to be the culprit behind a new wave of attacks targeting individuals and groups associated with the Association of Southeast Asian Nations (ASEAN) Member Nations. The group's new M.O.: using Dropbox to distribute its malware and WordPress for the initial stage of the command-and-control (C&C).

Dropbox, WordPress used as cloud cover in new APT attacks | Dark Reading