Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites

A cybercrime group accidentally left one of its servers exposed on the internet for three weeks, revealing the inner workings of its operation. The exposed server contained hacking tools, activity logs, and target lists with over 1.4 million websites named. Although not all listed sites were compromised, the exposed files provided insight into the mass site-hacking operation. The operation involved backdooring thousands of WordPress sites using WP-SHELLSTORM. Researchers were able to gain understanding of the operation's methods by analyzing the exposed files. The incident has given researchers a rare glimpse into the inner workings of a large-scale hacking operation.