Search/Stolen UpdraftCentral keys used to backdoor WordPress sites
● Story

Stolen UpdraftCentral keys used to backdoor WordPress sites

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an infrastructure provider supporting different partners across the ransomware ecosystem. "The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways," SOCRadar said. "They used AI-managed knowledge bases to track victims, stolen credentials, and campaign progress." A notable aspect that defines the campaign is its "AI-executed,…

View graph Export
CVEs
9
Highest CVSS
10
In KEV
8
Sources
4
Key vulnerabilities
top 3 of 9 by CVSS
CVE-2026-15409CVSS 10● KEV

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

CVE-2026-63030CVSS 9.8● KEV

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CVE-2026-9082CVSS 9.8● KEV

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Connections
29 relationships
Preparatevi all’Armageddon del ransomware! Le AI automatizzano tutto il flusso di violazione
Era da attenderselo, e ci siamo arrivati. I criminali informatici stanno passando a un nuovo modello di attacco in cui l’ intelligenza artificiale diventa non solo un assistente dell’aggressore, ma uno strumento per gestire quasi l’intera catena di penetrazione nell’infrastruttura aziendale.  Lo riportano i ricercatori di SOCRadar , che hanno scoperto un ecosistema di attacchi che coinvolgono affiliati dei gruppi INC e The Gentlemen che utilizzano l’ intelligenza artificiale per hackerare reti, rubare dati e preparare successive estorsioni. Al centro di questa infrastruttura c’è Phantom , un framework autonomo del Red Team che funziona su OpenCode e modelli linguistici commerciali accessibili tramite OpenRouter . L’operatore stabilisce gli obiettivi e controlla le azioni del sistema, ma le fasi effettive dell’invasione sono eseguite dagli agenti dell’intelligenza artificiale. Pertanto, una persona determina la direzione dell’attacco e l’intelligenza artificiale si assume una parte significativa del lavoro tecnico. I ricercatori hanno trovato registri contenenti 8257 messaggi in 133 sessioni. Se il modello si rifiutava di soddisfare la richiesta, l’operatore lo riformulava come un’attività di penetration testing autorizzata. Gli aggressori ottengono l’accesso iniziale attraverso servizi Internet e dispositivi periferici vulnerabili, tra cui FortiClient EMS, SimpleHelp, cPanel e gateway VPN . Il loro arsenale include vulnerabilità attivamente sfruttate quli le classiche CVE-2024-57727 , CVE-2026-35616 e CVE-2026-41940 . Altre vulnerabilità, comprese quelle relative a SonicWall, WordPress, LiteLLM e Drupal , sono state studiate, sviluppate per lo sfruttamento o menzionate nei materiali degli operatori. Una volta penetrato, il sistema aiuta a esplorare l’infrastruttura del dominio, raccogliere credenziali, cercare i privilegi di amministratore del dominio e navigare tra i nodi. Particolare attenzione è riservata ai documenti finanziari, ai dati sulle risorse umane, al materiale legale e alle informazioni gestionali. I tunnel SOCKS inversi vengono utilizzati per trasferire file. Strumenti aggiuntivi forniscono il ridimensionamento delle operazioni. WormGPT -MCP integra 3 2 server Model Context Protocol che collegano l’intelligenza artificiale con vari moduli, dall’intelligence all’estorsione . Ghost C2 include tre generazioni di malware polimorfico che comunica tramite Cloudflare, Telegram o DNS. RevSocks viene utilizzato per spostarsi attraverso reti compromesse e preparare i dati per l’esfiltrazione. Un compito separato è neutralizzare le misure di protezione . Gli aggressori utilizzano tecniche BYOVD , che consentono loro di utilizzare driver vulnerabili per aggirare i sistemi di sicurezza, nonché speciali meccanismi di bypass a livello di bootloader. Tuttavia, l’efficacia di questi metodi contro gli EDR aziendali è variata. Il cambiamento più allarmante è la transizione dall’automazione delle azioni individuali all’automazione dell’intero processo di intrusione. L’intelligenza artificiale aiuta a rilevare obiettivi, analizzare l’infrastruttura, utilizzare le credenziali, ottenere un punto d’appoggio nella rete e preparare il furto di informazioni. Gli esseri umani sono ancora coinvolti nell’esecuzione dell’operazione, ma la portata delle azioni eseguite dagli agenti amplia notevolmente le capacità dei criminali. Una volta rubati i dati, inizia l’estorsione personalizzata. Analizzando le informazioni finanziarie della vittima, gli aggressori cercano di determinare l’importo che l’organizzazione è in grado di pagare senza contattare una banca o una compagnia assicurativa . La pressione è accresciuta da prove falsificate, inviti preparati e minacce di divulgare informazioni a clienti, partner e autorità di regolamentazione. Se la vittima non paga entro 24-72 ore, i dati rubati potrebbero essere pubblicati su un sito di fuga di notizie. I ricercatori stimano che l’operazione abbia colpito 62 organizzazioni, quattro delle quali sono apparse sul Data leaks Site di INC e The Gentlemen. Più della metà degli obiettivi erano negli Stati Uniti. Tra i settori più colpiti ci sono quello manifatturiero, manifatturiero ed energetico, nonché sanitario e farmaceutico. I risultati finali del ransomware non sono noti: i ricercatori non sono stati in grado di rilevare portafogli di criptovaluta o percorsi di pagamento verificati. Questa campagna mostra come sta cambiando la natura stessa degli attacchi ransomware. Non si tratta più solo di malware che crittografa i file dopo la penetrazione. Si sta formando un’infrastruttura in cui l’intelligenza artificiale aiuta a organizzare un’intrusione, ad adattare le azioni a una vittima specifica e a preparare i suoi dati per il ricatto. La prossima frontiera è un’autonomia ancora maggiore di tali operazioni, in cui l’intervento umano sarà richiesto solo per fissare obiettivi e prendere decisioni chiave. L'articolo Preparatevi all’Armageddon del ransomware! Le AI automatizzano tutto il flusso di violazione proviene da Red Hot Cyber .
redhotcyber.comOct 25, 2026extracted
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
thehackernews.comOct 23, 2026extracted
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote
thehackernews.comOct 21, 2026extracted
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management: UpdraftPlus: website backup and restoration plugin with more than 4 million downloads UpdraftCentral: for managing multiple sites remotely UpdraftVault: for cloud backup storage UpdraftClone: for creating staging websites "Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website," TeamUpdraft said in an advisory yesterday. "Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected." The vendor says it believes the threat actor accessed its customer database, which included details about the customer and billing, order history, as well as more sensitive information: password hashes two-factor authentication settings connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services The vendor said it did not store any payment details and noted that UpdraftPlus plugin files and downloads remain unaffected. Self-hosted UpdraftCentral instances are not impacted. Even if backups in customers' own remote storage are unaffected, the company recommends that users rotate storage credentials and reauthorize connections if they accessed their site through UpdraftCentral. Massive blast radius An estimated 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key, potentially exposing around 400,000 websites to the attack. According to Patchstack lead researcher Oliver Sild, attackers have begun using stolen access keys to backdoor sites connected to UpdraftCentral, saying the campaign may be more severe than the "wp2shell” attack. The WordPress plugin security company says that the attacks started on October 18 at 15:32 UTC to execute arbitrary code and add accounts with full administrator privileges. The researchers logged at least 99 malicious backdoor plugins with distinct names disguised as WordPress maintenance and optimization tools, such as “Site Health Cache.” Although Patchstack describes an early variant of the backdoor plugin that is broken due to a coding error, a report from web application security firm Nethemba documents a newer version that lets attackers create privileged accounts or log in as existing administrators. Nethemba says three of its own WordPress websites were targeted through UpdraftCentral, with malicious plugins successfully installed on two of them. “All three sites ran the current WordPress 7.1.3 and UpdraftPlus 2.26.11, which is patched against the June vulnerability CVE-2026-10795,” Nethemba says. “The attacker did not break into our servers and did not exploit any weakness in our configuration. The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys” Nethemba reports that the vendor's initial 1.26.12/2.26.12 release was meant to remove UpdraftCentral Cloud keys, but a bug prevented it from doing so. Users are recommended to update UpdraftPlus to 1.26.13 (free) / 2.26.13 (Premium) or later. After updating, it is recommended to log into each WordPress site and delete the UpdraftCentral connection keys from Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys. Administrators should inspect logs and files for indicators of compromise provided by TeamUpdraft, Patchstack, and Nethemba. If compromise is confirmed, it is recommended to restore sites from clean backups, change the TeamUpdraft account password, revoke all sessions, and reset the two-factor authentication protection method. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comOct 21, 2026extracted
Related Stories
1
Stolen UpdraftCentral keys used to backdoor WordPress sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managing multiple sites remotely. A client component of UpdraftCentral is shipped within every copy of UpdraftPlus. "Over the weekend of 17-18 October we identified unauthorized access to the teamupdraft.com website," TeamUpdraft said in a statement. "Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected." As a result of the incident, threat actors are believed to have accessed its customer database, which holds the following information - Names, email addresses, billing addresses and order history Account passwords, stored only in hashed (scrambled) form and never in plain text Two-factor authentication (2FA) settings Connection keys for UpdraftCentral, UpdraftVault and UpdraftClone TeamUpdraft said the database does not hold any financial information, and that they are handled by Stripe and PayPal. It also emphasized that the UpdraftPlus plugin, along with self-hosted versions of UpdraftCentral and backups sent to customers' own remote storage, are not impacted. "However, if your site was accessed through UpdraftCentral, please also re-authorise your remote storage and change any storage access keys, as a precaution," it said. In addition, TeamUpdraft said it deployed a fix to address the underlying issue, signed out every teamupdraft.com account and reset login security across the site, and released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on October 18, 2026, to prevent the old keys from working. Other steps taken by the developer are listed below - Disconnected every site from UpdraftVault and issued new credentials Replaced every UpdraftClone client key Rotated its keys with payment providers and other connected services Implemented additional monitoring in place Reported the incident to the U.K. Information Commissioner's Office (ICO) and other relevant authorities Users who have a teamupdraft.com account are advised to change their password with immediate effect (and elsewhere, if the same password has been reused), reset 2FA settings, and exercise caution when receiving unexpected emails claiming to be from TeamUpdraft. TeamUpdraft is also recommending that cloud customers of UpdraftCentral follow the steps below as soon as possible, since the connection keys can send commands to the connected sites - Log in to the site's own WordPress dashboard, not through UpdraftCentral. Update UpdraftPlus to version 1.26.12 (free) or 2.26.12 (Premium) or later. Disconnect it from UpdraftCentral: go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key. Go to Users and check for any administrator accounts you don’t recognise. Remove them. Go to Plugins, including the Must-Use tab if you can see it, and check for anything you don’t recognise. Remove it. Change the passwords for all administrator accounts on the site. If you find anything suspicious, consider restoring the site from a backup taken before 17 October. Reconnect the site to UpdraftCentral. UpdraftVault users are being urged to reconnect their sites to the backup service, and UpdraftClone users who have created a client key are required to copy the new keys from My Account > UpdraftClone > UpdraftClone Key Management and share them with their clients. The development comes as WordPress security company Patchstack said it observed an attacker holding valid UpdraftCentral dashboard keys issuing commands to install backdoor plugins on connected WordPress sites. The campaign is said to have run continuously through an 18-hour window on October 18 and 19, 2026. "The attacker sends a signed plugin.upload_plugin command over the plugin's remote procedure call channel, which listens on ordinary POST requests to the site root. WordPress installs and activates the supplied plugin through its standard installer," Patchstack security researcher Dave Jong said. Slovakia-based penetration testing company Nethemba, which first detected the attack in the wild, has described the rogue plugin as a backdoor that hooks into every request to the site to check if the URL contains the parameter "?_9f5696=" and compares it with a 32-character token. If a matching token is detected, it creates a user "data-ops43" with the display name "Site Tools," assigns it the Editor role, and grants the account "manage_options" and "install_plugins" permissions, allowing the operator to upload arbitrary PHP plugins and open site settings. "Enabling registration and setting the default role to administrator is enough for the attacker to create a full administrator," Nethemba said. "On a standard WordPress site, an Editor also has unfiltered_html, so the account can put JavaScript into posts that runs in the browser of every administrator." "The backdoor has a second layer as well. The account it creates, with a known password, stays in WordPress even after the plugin is removed, and the attacker can log in with it through the normal login form unless two-factor authentication is enabled for that account." Although an early version of the plugin suffered from a coding error that causes impacted sites to fail with error 500, Nethemba said the threat actor deleted the broken backdoor by sending a "plugin.delete_plugin" command and then uploaded a working version that creates a full administrator account or logs in as an existing administrator. WordPress site owners are advised to check for the following indicators of compromise - Plugin names: Site Health Cache or Site Health 364F, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, Style Bridge 8F5, Media Kit 183, Query Shelf, Post Dock 776, Nav Hub, Speed Desk, Speed Kit 300, Link Latch, Script Shelf, or Feed Case Account names: system_team850, web.tech988, cmseditor170, cms.tech644 or web_mgr684, with an email at @example.com and a display name such as System Team, Web Tech, System Staff, System Ops, or Cms Tech IP addresses: 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9 In all, Patchstack said it observed 99 distinct backdoor plugin names, with each sample carrying the line "Small maintenance toolkit: keeps option storage tidy." Wordfence, which published its own analysis of the incident, said a WordPress site may be affected if the below criteria are satisfied - The site had UpdraftPlus Free or UpdraftPlus Premium installed and active while the affected UpdraftCentral connection key was present. The site has, or had during the incident, an active connection key for TeamUpdraft’s cloud-hosted UpdraftCentral service. "This is the second incident in this channel in five months," Patchstack warned. "In June 2026 the vendor fixed CVE-2026-10795 (CVSS 8.1), where an obsolete unsigned message format let an attacker forge UpdraftCentral commands with no keys at all. That was fixed in 1.26.5 and 2.26.5, but exploitation attempts continue, so sites below those versions face both problems at once." The development comes days after the website of the Rank Math PRO WordPress plugin was hit by a software supply chain attack, causing users who downloaded version 3.0.123 between October 15 at 8:02 p.m. UTC and October 16 at 7:12 a.m. UTC to receive compromised versions that planted hidden backdoors. The incident has been assigned the CVE identifier CVE-2026-111862 (CVSS score: 9.8). The issue was fixed in Rank Math PRO version 3.0.124. "The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server," Wordefence said. The findings also coincide with an advisory from PHP, which said it intends to ship a security release that fixes two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS scores: 9.2), as information about the flaws leaked ahead of their scheduled disclosure. The flaws have been codenamed PHP2Shell. According to watchTowr CEO Benjamin Harris, the vulnerabilities affect PHP versions 5, 6, 7, and 8, and were originally due for release on October 22 at 11 a.m. ET. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," Huntress said. "When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast."
10 shared
Oct 22, 2026