Check Point Research: Nearly 2,000 hacked WordPress websites are being used to spread malware and deploy ransomware

Comparing news, cybersecurity company Check Point Research found that the StopAndProtect ransomware operation used nearly 2,000 hacked WordPress sites to spread malware, steal data, monitor victims, and deploy ransomware. The operation was discovered in mid-May. As of July 24, the operation had invaded more than 6000 unique IP addresses, of which 1,852 were in the US and 630 each in Russia and India.

Hacked websites are also used to host malware, send instructions, and store stolen files, screenshots, and activity logs. Attackers use fake CAPTCHAs to trick Windows users into running PowerShell commands, thereby stealing credentials and cryptocurrency wallet mnemonics, and spreading through networks and USB devices. The researchers collected more than 31,000 screenshots and over 700 data packages, and believed that the attackers might have mistakenly infected themselves.