Check Point Research: Nearly 2,000 Hacked WordPress Sites Used to Spread Malware and Deploy Ransomware

Cybersecurity firm Check Point Research has found that the StopAndProtect ransomware operation used nearly 2,000 compromised WordPress websites to spread malware, steal data, monitor victims, and deploy ransomware. The operation was discovered in mid-May. As of July 24, it had compromised over 6,000 unique IP addresses, including 1,852 in the United States, with 630 each in Russia and India. The compromised sites were also used to host malware, send commands, and store stolen files, screenshots, and activity logs. Attackers lured Windows users into running PowerShell commands via fake CAPTCHAs, thereby stealing credentials and cryptocurrency wallet seed phrases, and spreading across networks and USB devices. Researchers collected over 31,000 screenshots and more than 700 data archives, and believe the attackers may have accidentally infected themselves.