CyberzSOC

As part of this campaign, malicious cyber actors are actively scanning websites for opportunities to deploy webshells, leveraging various vulnerabilities affecting CMS software and plugins. These vulnerabilities primarily allow unauthenticated file upload, remote code execution, server side request forgery or deserialisation. Once deployed, webshells can allow malicious cyber actors to remotely access and control targeted web servers. Malicious cyber actors may leverage compromised web servers for several purposes, including: Website defacement or disruption Capturing credentials entered by website users or other data stored on web servers Uploading additional malware to target and scam legitimate website users Using web server access as a pathway for broader network compromise The software, plugins and CVEs being exploited include: GutenKit/Hunk Companion (WordPress) This highly scaled global exploitation campaign demonstrates the rapidly evolving cyber risk facing organisations.