WordPress Incident Response: 13k Brute-Force Attempts, Webshells & Persistence

Executive Summary

Technical WordPress incident engagement for an anonymized corporate client, with application compromise, mass malicious content creation, and persistence through webshell files. The engagement followed a four-phase incident response methodology: containment, forensics, eradication, and hardening.

Technical lead: Percio Andrade Castelo Branco (Infrastructure and Cyber Defense).

Scope and Engagement Assumptions

• Affected platform: WordPress (application layer).
• Host impact: no evidence of structural compromise in base hosting.
• Operational severity: 6/10 (moderate incident with relevant functional compromise).
• Attacker objective: use the site as a malicious content distribution and redirect point.

Identified Attack Chain

1. Massive XML-RPC brute-force attempts (high volume in short time window).
2. Administrative WordPress access obtained (hypothesis supported by action traces in admin panel).
3. Use of a file manager plugin to upload payloads go.php and lol.php.
4. Deployment of ZIP persistence package (2022a.zip) containing fallback file.
5. Active theme switching and template edits (header/footer) to support malicious campaign.
6. Automated mass generation of unauthorized content (191 posts).

Confirmed Technical Indicators (IOC)

Artifacts directly linked to the incident, sanitized for publication:

/home/client_redacted/public_html/web/go.php
/home/client_redacted/public_html/web/lol.php
/home/client_redacted/public_html/wp-content/uploads/2022a.zip
/home/client_redacted/public_html/wp-content/uploads/2022a.zip/a.php
/home/client_redacted/wp-content/mu-plugins/index.php
/home/client_redacted/wp-content/mu-plugins/2022a.zip

• Behavioral IOC: creation of hundreds of unauthorized posts.
• Authentication IOC: 13,940 XML-RPC brute-force attempts recorded.
• Integrity IOC: unauthorized active theme change and visual template modifications.

Operational Timeline (T0/T1/T2...)

• T0 - Activation: incident intake with signs of malicious content and layout defacement.
• T1 - Containment: site removal from original environment and migration to isolated alternative server.
• T2 - Forensics: artifact collection, log analysis (server + WordPress), and vector/IOC validation.
• T3 - Eradication: payload removal, post cleanup, theme/plugin review, and alteration correction.
• T4 - Hardening: stack updates, firewall/app security reinforcement, credential rotation, and additional controls.
• T5 - Validation: final scan, functional validation, and post-incident technical dossier issuance.

Technical Execution by Phase

Phase 1 - Containment

1. Immediate environment isolation to stop real-time attacker actions.
2. Evidence and baseline preservation before destructive cleanup.
3. Preparation of secure remote environment for incident handling.

Phase 2 - Forensics

1. Database and application/server log analysis.
2. Signature-based detection (hash/known patterns) and heuristics.
3. Scanning with auxiliary scripts (Shell/Python) for batch triage.
4. Validation with Wordfence (basic/advanced scan) to reinforce coverage.

Phase 3 - Eradication

1. Manual removal of go.php, lol.php, and compressed persistence artifacts.
2. Cleanup of unauthorized content and rollback of malicious visual changes.
3. Active theme rollback to previously identified legitimate baseline.

Phase 4 - Hardening

1. Update of all plugins, themes, and WordPress core to current versions.
2. Wordfence activation with firewall in advanced mode.
3. Installation of admin surface hardening plugin (HideMyWP) for later stage in final environment.
4. Application of .htaccess controls and XML-RPC disablement/restriction as required.
5. Full credential rotation for privileged users and database (values suppressed in this public report).

Operational Commands and Routines (Representative)

# 1) Initial inventory of PHP changes
find /var/www/site -type f -name "*.php" -mtime -30 | sort

# 2) Search for common obfuscation/webshell patterns
grep -RniE "base64_decode|gzinflate|eval\\(|assert\\(|preg_replace\\(.*/e" /var/www/site

# 3) Administrative user review
wp user list --role=administrator --path=/var/www/site

# 4) Cache cleanup and environment revalidation
wp cache flush --path=/var/www/site
wp core is-installed --path=/var/www/site
wp plugin list --path=/var/www/site

# 5) Permission reinforcement after remediation
find /var/www/site -type d -exec chmod 755 {} \\\;
find /var/www/site -type f -exec chmod 644 {} \\\;
chown -R www-data:www-data /var/www/site

Elementor and Layout Integrity

During analysis, it was confirmed that the attacker also edited builder templates (header/footer and structural pages), causing visual and functional frontend impact. The threat actor forced active theme switching to blank-canvas to facilitate stealthy link injection. Because local versioning was unavailable, I utilized historical timeline analysis on the Wayback Machine (Archive.org) as a forensic method to reconstitute the pre-incident baseline, uncovering that the legitimate active theme was seedlet. The theme was reverted and Elementor layout structures and templates were sanitized and restored.

SEO/Reputation Impact

• The attacker executed an automated A-to-Z keyword injection SEO spam campaign, resulting in 402 malicious URLs indexed by Google.
• Index cleanup executed via Google Search Console URL removal requests alongside updated XML sitemap resubmission.
• Post-remediation monitoring established to accelerate removal of cached artifacts and restore organic search trust.

Operational Metrics and Outcome

• Environment recovered from compromised state to stable functional operation.
• 191 malicious posts identified and treated in eradication scope.
• 13,940 XML-RPC brute-force attempts confirmed in log trails.
• Persistence plan B (2022a.zip) intercepted and eradicated before backdoor reactivation.
• Administrative surface hardened with additional protection layers.

Visual Evidence from the Engagement

Sanitized technical screenshots (no sensitive data):

image_02 - Initial artifact linked to the incident.

image_03 - Attack trail with payload delivered to the environment.

image_04 - Persistence/re-entry point evidence.

image_05 - Technical validation of incident logs.

image_06 - Mass cleanup of unauthorized content.

image_07 - Hardening stage applied.

image_08 - Reinforcement of security controls.

image_09 - Review/fix of affected templates.

image_10 - Post-remediation state with stable baseline.

image_11 - Final remediation validation.

image_12 - Final proof of technical delivery.

Prioritized Lessons (Security Backlog)

1. P1 - Edge XML-RPC blocking: disable XML-RPC and deploy Cloudflare CDN/WAF to mitigate distributed attacks and brute-force before touching origin infrastructure.
2. P1 - Plugin governance: eliminate arbitrary upload utilities like WP File Manager and review hosting operational permissions.
3. P1 - Server stack upgrade: update hosting PHP runtime to the latest supported and secure version, ensuring security patches and performance optimization.
4. P1 - Continuous monitoring: alert on automated bulk post generation and unauthorized visual template edits.
5. P2 - Layout governance: daily backups and versioning of critical templates (header/footer/home) for immediate rollback.
6. P2 - Reputation and SEO: proactive Search Console URL eviction protocols to shut down SEO spam poisoning.

Document Reference

Based on anonymized technical dossier: INCIDENT_SECURITY_DOSSIER-2.0.