Threat Intel
StopAndProtect: Ransomware Operation Hijacking Thousands of WordPress Sites
RootPwn’s latest intel uncovers StopAndProtect, a multi‑stage ransomware campaign that exploits compromised WordPress sites for download, command & control, and data exfiltration. The attack chain starts with a ClickFix social‑engineering lure that forces victims to run a PowerShell command, spawning .NET loaders, a SMB/USB worm, a lock‑screen module, a VBS spreader, a chat utility and a credential stealer. While not all victims receive file encryption, attackers silently harvest documents, logs and screenshots, uploading them to the same compromised sites. OPSEC lapses exposed thousands of IP
In mid‑May 2026, security researchers first spotted a new ransomware family dubbed StopAndProtect. What followed was a sprawling operation that turns every hacked WordPress site into a node of the attackers’ infrastructure.
Infection Chain
- Social‑engineering trigger: A fake ClickFix CAPTCHA prompts users to run a PowerShell command.
- Two‑stage download: The command pulls down .NET loaders that bootstrap the rest of the payload.
- Modular toolkit: Components include a ransomware engine, an SMB/USB worm, a lock‑screen module, a VBS spreader, a live‑chat utility and a credential stealer.
- Selective payload: Not every victim gets encrypted; many are quietly exfiltrated for data theft.
WordPress as the Backbone
- Compromised sites host additional downloaders, act as C&C servers, and store stolen logs and documents.
- OPSEC failures exposed PHP scripts with directory listings, revealing thousands of logs and a 2,000‑domain compendium.
- Scanning one infected site uncovered a 2021‑era WordPress core plus ~40 vulnerabilities—expired certs, SQLi, open redirects, auth bypasses, arbitrary file uploads, and more.
Scale & Impact
- Thousands of IP addresses affected, primarily from the US, Russia and India.
- Attackers captured telemetry, logs, and screenshots from infected machines, giving them a near‑real‑time view of progress.
- Some operators even uploaded their own desktop files to the collection server—an accidental leak of source code and a list of compromised domains.
Mitigation Recommendations
- Patch WordPress core, themes and plugins to the latest versions.
- Disable or restrict file‑upload capabilities on all sites.
- Block outbound PowerShell execution and monitor for suspicious .NET downloads.
- Implement web‑application firewalls to detect and block ClickFix‑style prompts.
- Regularly audit server directories for exposed listings and unexpected files.
“This is a textbook example of how a single compromised site can become a launchpad for a global cyber‑crime operation.” – RootPwn Threat Analyst
Related articles
Black Axe Syndicate Leaders Extradited to U.S. on Wire Fraud and Money Laundering Charges
Five alleged leaders of the notorious Black Axe cybercrime gang were flown from South Africa to the United States on September 11 to face wire‑fraud, money‑laundering and aggravated identity‑theft charges. Prosecutors say the group ran a decade‑long romance‑scam scheme that tricked U.S. victims into sending money, using social‑media profiles, dating sites and VoIP calls. The extradition follows a global operation that saw 58 arrests across 22 countries, highlighting the U.S. commitment to bring transnational fraudsters to justice.
Read briefing
CrowdStrike & Partners Strike Down Sality Botnet in Coordinated Disruption
In a joint effort with international law‑enforcement agencies and industry allies, CrowdStrike executed the “Peer Pressure” operation to dismantle the Sality peer‑to‑peer botnet. The campaign severed command‑and‑control channels, seized malicious infrastructure, and disrupted the botnet’s ability to distribute ransomware and other payloads. The takedown removes a key threat vector that has infected millions of hosts worldwide, demonstrating the power of coordinated cyber‑defense operations.
Read briefing
Chinese‑speaking gang hijacks Brazilian government sites to weaponise SEO for phishing and gambling scams
Since mid‑2025, a Chinese‑speaking cyber‑crime cluster dubbed Gambling Goblin has been infiltrating Brazilian government and educational web servers. By installing custom Apache modules, the attackers silently reverse‑proxy visitors to a vast network of phishing pages that masquerade as trusted app stores. The compromised high‑reputation domains are then leveraged to boost the attackers’ own content in search results, driving traffic to gambling and sports‑betting sites. The group deploys a heavily obfuscated Linux toolkit—including backdoors, credential stealers and reconnaissance agents—maki
Read briefing
AI‑Powered Attack Hits 395 PaperCut Servers Across 48 Countries
A likely Russian‑speaking threat actor leveraged hundreds of AI agents to craft, test, and launch a global campaign against PaperCut NG/MF servers, exploiting CVE‑2026‑81578 and CVE‑2026‑82078. Within hours of launching, the attackers achieved remote code execution, escalated to domain admin in minutes, and compromised 395 organizations—roughly half in education—across 48 nations. The operation used pass‑the‑hash, DCSync, and custom Rust utilities to harvest credentials and domain secrets. Immediate patching of the two CVEs is mandatory.
Read briefing