Security researchers have uncovered an unsecured server belonging to a hacking group that was conducting mass attacks against WordPress and Joomla websites. The exposed infrastructure revealed extensive details about the campaign, dubbed WP-SHELLSTORM, including lists of 1.4 million potential targets, exploit code, logs, and data on successful compromises.
The server, located at IP address 137.175.93[.]126 and lacking any password protection, was discovered by specialists from SOCRadar and Ctrl-Alt-Intel. The attackers had left approximately 800 megabytes of data in open access, comprising 434 files containing web shells, scripts, scan results, command-and-control infrastructure configurations, and command history. The leak occurred due to a simple human error: one of the attackers launched a basic Python HTTP server for file transfer purposes and failed to shut it down for 22 days.
How Did the WP-SHELLSTORM Group Operate?
According to researchers, the WP-SHELLSTORM operators functioned as access brokers. The hackers searched for vulnerable websites, deployed web shells on them, and could then sell access to compromised resources to other criminals. The threat actors compiled their target lists using the Chinese search engine FOFA, after which automated scanners checked them for 27 known vulnerabilities, primarily affecting various WordPress plugins.
The most effective vulnerability for conducting these attacks proved to be CVE-2026-3844 in the Breeze caching plugin. Exploits for this vulnerability were used against more than 45,000 websites, and according to the attackers’ logs, web shells were successfully installed on over 17,000 of them.
How Many Sites Were Actually Compromised?
While approximately 1.4 million domains appeared in the attackers’ target list, the actual number of compromised sites was lower. Analysts from Ctrl-Alt-Intel counted 25,195 resources with confirmed signs of compromise, while SOCRadar discovered more than 5,700 active web shells still operational on victim sites.
The hacking group’s primary tool was an obfuscated file called down.php, presumably created based on the Chinese web shell BestShell. This tool enabled file operations, command execution, reverse shell launching, network scanning, and security software detection. For accessing their own infrastructure, the group employed the SNOWLIGHT dropper and VShell backdoor, which disguised its process name to appear as a system kernel thread.
What Other Malicious Activity Was Discovered?
The hackers’ server also contained traces of another malicious campaign. In early May 2026, the attackers compromised 11 Java systems belonging to nine companies from the fintech, e-commerce, logistics, gaming, and electronics sectors. Using the old CVE-2021-29441 vulnerability in Nacos, the attackers stole 613 configuration files containing AWS, Alibaba Cloud, Oracle, Tencent and DigitalOcean keys, database passwords, and private RSA keys for Alipay.
Researchers believe a Chinese-speaking group motivated by financial gain is behind the WP-SHELLSTORM attacks. This assessment is based on Chinese language found in code and command history, the use of FOFA, and tools popular in Chinese-speaking environments such as Godzilla and VShell.
Source: Xakep