Alert: CryptoPHP backdoor is a serious threat!

One week after the Fox IT security firm published a report revealing CryptoPHP backdoor, a new report has been published showing the impact of this threat. Security firm said that since then, it was busy dealing with affected servers and taking down the CryptoPHP infrastructure, together with other parties.

The new report published by the firm reported that they worked out with different national agencies such as NCSC, Abuse.ch, Shadowserver and Spamhaus and were able to gather data about the range of the attack mitigated by the CryptoPHP authors. The report reads,

"Most C2 domains that were active at the time of publishing have been either sinkholed or taken down. From the sinkholed domains we've been able to gather statistics."

Overall a total of 23,693 unique IP addresses connected the sinkholes. This means, there have been this number of websites that reached through backdoor to the attacking websites, but now are being sinkholed and not sent back to the attacker, rather reverted to a false domain to prevent further damage, or loss of information to the attackers.

The stats gathered by the firm noted a decline in numbers as below:

20,305 connections on 22nd November

18,994 connections on 23rd November

16,786 connections on 24th November

According to the report,

"These numbers are however not a clear indication, mostly because the servers connecting to our sinkholes were shared hosting with at least 1 or multiple backdoored websites. This means the actual affected websites will be higher. Unfortunately we are also unable to make statistics on whether the affected server is running WordPress, Joomla or Drupal. This information is encrypted using public key encryption as explained in the paper."

Last week, Fox IT revealed a serious backdoor that was being spread through Custom themes and Plugins used for CMS based websites, such as Wordpress, Joomla and Drupal, by many websites offering pirated versions of these products.

Now the updated report says that a new version of the backdoor has been identified, although the version number wasn't changed, but the new filehash made it clear. The SHA1 hash for the file is c4fe641e3410fb047004c9653c79124c32a66446; the version number is still 1.0.

Also, it is said that on 23rd of november, most of the websites, spreading these backdoored products, went offline. But a day after that they again regained to normal, and were found online till this report was published.

Fox IT again explained methods to detect and remove the backdoors from the products.

Detection

Download two python scripts from Here:

https://www.github.com/fox-it/cryptophp/scripts/

check_filesystem.py is for scanning the filesystem for the CryptoPHP backdoor files. It will find all social*.png files and determine if it's malicious. And check_url.py script can scan a website to determine if the website is affected by CryptoPHP. This can be useful if you have multiple virtual hosts and don't know which one is affected.

Removal

If CryptoPHP has been found we recommend the following steps:

Remove the include of the backdoor. For example, find the script that contains: . Note that this path can vary. Remove the backdoor (social*.png) itself by deleting it. Check your database to see if any extra administrator accounts were added and remove them Reset the credentials of your own CMS account and other administrators (they were most likely compromised)

Though the steps are sufficient to remove the impact CryptoPHP has had on a website, still the users are recommended to reinstall their CMS since the system integrity may have been compromised. An attacker may have gained system wide access for example. Also, we advise our users not to install any kind of pirated (nulled) plugins and themes to avoid any future attacks on their websites.