Full Report
Research by: Jaromír Hořejší (@JaromirHorejsi) Key points Introduction We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional downloaders and […] The post Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect appeared first on Check Point Research.
Analysis Summary
# Threat Actor: StopAndProtect (Operation)
## Attribution & Identity
- **Actor Name:** StopAndProtect (derived from the ransomware family used in the operation).
- **Identity:** Currently unidentified cybercriminal group.
- **Key Associations:** The group utilizes the "ClickFix" social-engineering lure, which is a technique observed across various modern malware campaigns to trick users into executing malicious code.
- **OPSEC Failures:** The developer inadvertently exposed their identity and tools due to poor operational security, including a PHP script that allowed directory listing of their collection servers.
## Activity Summary
- **First Noticed:** May 2026.
- **Campaign Scope:** A large-scale operation involving thousands of compromised WordPress sites used as infrastructure.
- **Operational Flow:** The campaign combines traditional ransomware (file encryption) with silent data exfiltration and screen locking. It is characterized by extensive telemetry and logging of victim machines.
## Tactics, Techniques & Procedures
- **Initial Access:** Social engineering via the "ClickFix" technique, prompting victims to copy and execute a malicious PowerShell command.
- **Execution:** Multi-stage infection chain.
- Stage 1: PowerShell command execution.
- Stage 2: Two stages of .NET-based downloaders and loaders.
- Stage 3: Deployment of functional modules (ransomware, stealer, etc.).
- **Persistence & Lateral Movement:**
- SMB/USB Worm for network and physical drive propagation.
- VBS Spreader for further distribution.
- **Command & Control (C2):** Abuse of hacked WordPress websites (running vulnerable/outdated versions) to host payloads, receive C2 commands, and store exfiltrated logs.
- **Data Exfiltration:** Silent exfiltration of file lists and specific documents before or instead of encryption.
- **Direct Interaction:** Use of a custom chat utility to communicate with victims for ransom negotiations.
**MITRE ATT&CK IDs (Inferred from TTPs):**
- **T1566.002:** Phishing: Spearphishing Link (ClickFix)
- **T1059.001:** Command and Scripting Interpreter: PowerShell
- **T1584.004:** Compromise Infrastructure: Server (Hacked WordPress sites)
- **T1486:** Data Encrypted for Impact
- **T1048:** Exfiltration Over Alternative Protocol
## Targeting
- **Sectors:** Broad opportunistic targeting; any user visiting a compromised site or falling for the ClickFix lure.
- **Geography:** Global, with the highest concentration of victims in the **United States**, **Russia**, and **India**.
- **Victims:** General users and organizations; internal logs suggest thousands of unique IP addresses have been affected.
## Tools & Infrastructure
- **Malware Toolkit:**
- **StopAndProtect:** Ransomware component for file encryption.
- **Credential Stealer:** For harvesting sensitive information.
- **LockScreen:** To prevent user access to the desktop.
- **SMB/USB Worm:** For lateral movement.
- **Chat Utility:** For attacker-victim communication.
- **Infrastructure:**
- **WordPress Sites:** ~2,000 compromised domains used for hosting and C2.
- **Defanged Domains/Paths:**
- `https[:]//research[.]checkpoint[.]com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/`
- Known developer path found in strings: `C:[\\]Users[\\]marks[\\]source[\\]`
## Implications
StopAndProtect represents a highly organized, automated cybercrime operation. By repurposing thousands of legitimate but vulnerable WordPress sites, the actors minimize their own infrastructure costs and increase the difficulty of IP-based blocking. The shift from pure ransomware to a "toolkit" approach (theft, locking, and encryption) allows the actor to monetize victims who may not pay a ransom but possess valuable data.
## Mitigations
- **For Website Owners:**
- Regularly update WordPress core, themes, and plugins to the latest versions.
- Implement strong authentication and scan for known vulnerabilities (SQLi, Auth Bypass).
- Monitor for unauthorized file uploads or suspicious PHP scripts.
- **For End Users/Organizations:**
- **User Training:** Educate employees on the "ClickFix" lure (e.g., warnings about "fixing" browser issues by running PowerShell commands).
- **PowerShell Restrictions:** Enforce Constrained Language Mode or restrict PowerShell execution to signed scripts via GPO.
- **Endpoint Protection:** Utilize EDR/AV solutions to detect the multi-stage .NET loaders and known StopAndProtect file hashes.
- **Network Monitoring:** Block access to known compromised WordPress URLs and monitor for unusual outbound traffic to CMS-based sites.