# Inside WP-SHELLSTORM: How an Exposed Hacker Server Revealed a Mass Backdooring Operation
A misconfigured server left running for three weeks has exposed the inner workings of one of the largest automated website-hacking operations discovered to date. Security researchers gained unprecedented visibility into WP-SHELLSTORM, a webshell access brokerage that systematically exploits WordPress and Joomla vulnerabilities at massive scale. The leaked files reveal thousands of backdoored websites, targeting lists spanning 1.4 million domains, and the technical arsenal used to compromise sites for resale to other cybercriminals.
## The Threat
WP-SHELLSTORM operates as a webshell access brokerage—a criminal operation that breaks into websites at scale, plants hidden backdoors, and then packages those compromised sites for resale to other threat actors. The operation was discovered when a server at 137.175.93[.]126 was left publicly accessible with no authentication, containing approximately 800MB of operational data across 434 files.
The exposed archive included:
Two independent security research teams—SOCRadar and Ctrl-Alt-Intel—analyzed the exposed directory after discovering it in June 2026. The operation's persistence was straightforward: the operator had launched a simple Python web server to move files around and inadvertently left it running for 22 days before the breach was discovered.
## Background and Context
WP-SHELLSTORM exploits publicly known vulnerabilities in website plugins—bugs that have been disclosed, patched, and assigned CVE identifiers, yet still widely present in real-world deployments. The operation's toolkit covered 27 known flaws, primarily targeting WordPress and Joomla platforms where administrators had failed to update their software.
The workflow is consistent with industrial-scale exploitation:
1. Reconnaissance: Target lists pulled from FOFA, a Chinese internet search engine similar to Shodan
2. Scanning: Automated tools identify websites running vulnerable plugin versions
3. Exploitation: Known-vulnerability exploits upload webshells to compromised servers
4. Monetization: Access sold to other threat actors for credential harvesting, ransomware deployment, or site defacement
The operation demonstrates how attackers can industrialize cybercrime through automation. Rather than targeting high-value organizations manually, WP-SHELLSTORM sprays exploits across hundreds of thousands of targets, accepting low success rates in exchange for a high volume of compromised assets.
## Technical Details
### Primary Vulnerabilities
The strongest attack vector was CVE-2026-3844, a vulnerability in the Breeze caching plugin for WordPress. The leaked logs showed:
However, this flaw came with a critical caveat: the vulnerability only works when the "Host Files Locally – Gravatars" setting is enabled—a non-default configuration. Most Breeze installations were not vulnerable, meaning the actual impact was limited to sites with specific configurations.
The second major target was a Joomla JCE editor vulnerability, which the crew attempted to exploit against 560,000+ targets. Despite the massive target list, this exploit yielded only 77 confirmed compromises—a stark reminder that high target numbers do not equate to high compromise rates.
### Backdoor Arsenal
The primary backdoor, named down.php, was heavily obfuscated across four layers of encryption. Security researchers determined it was derived from BestShell, an open-source Chinese webshell. Once installed, down.php provided:
For persistence and remote access, the crew deployed a SNOWLIGHT dropper to install VShell, a sophisticated backdoor that disguises its running process as [kworker/0:2] to blend in with legitimate kernel threads. This evasion technique prevents detection through simple process listing commands—a common way administrators identify suspicious activity.
### The Numbers: Context Matters
The headline figure of 1.4 million targeted domains requires careful interpretation:
| Metric | Value | Note |
|--------|-------|------|
| Domains on target lists | 1,400,000 | Cumulative across all campaigns |
| Joomla targets (largest single list) | 587,034 | WordPress and other platforms in separate files |
| Confirmed or validated compromises (Ctrl-Alt-Intel) | 25,195 | Deduplicated, conservative count |
| Active webshells found (SOCRadar) | 5,700+ | Live backdoors still accessible |
Being on a hacker's target list is fundamentally different from being successfully compromised. The Joomla vulnerability illustrates this gap: exploited against 560,000 targets but successful on only 77.
## Implications
### For WordPress and Joomla Site Owners
This breach demonstrates that patch management remains critical. The vulnerabilities exploited by WP-SHELLSTORM are not zero-days; they are known bugs with published fixes. Site owners running out-of-date plugins created the conditions for this mass compromise.
The financial incentive for maintaining compromised sites as long as possible means some backdoors may persist for years. Attackers will:
### For the Broader Threat Landscape
WP-SHELLSTORM is not an isolated incident. The leaked files revealed continuity with earlier campaigns: the same SNOWLIGHT-to-VShell tool chain was linked by Sysdig to an April 2025 operation. This suggests an organized, persistent threat actor with evolving capabilities and stable infrastructure.
The existence of webshell access brokerages creates a two-tier market for cybercrime:
1. Tier 1: Specialized attackers who identify and exploit vulnerabilities at scale
2. Tier 2: Purchasers of compromised access who lack technical expertise but can deploy ransomware, steal data, or commit fraud
This layering reduces barriers to entry for less-skilled threat actors and accelerates the speed at which compromised assets can be weaponized.
## What Defenders Must Do
### Immediate Actions
For WordPress users:
For Joomla administrators:
For all site owners:
### Medium-Term Hardening
---
## HackWire Analysis
The WP-SHELLSTORM leak is a masterclass in how operator error defeats sophisticated evasion techniques. The attacker deployed process-name spoofing and multi-layer obfuscation but was undone by leaving a development Python web server running—a mistake that speaks to the operational tempo and pressure this crew operates under. The volume of targets (1.4 million) and the industrial automation required to manage them suggests this operation is significantly larger than a lone researcher. Instead, it points to an organized team, likely outsourcing reconnaissance and exploitation, coordinating resale channels, and maintaining persistent infrastructure.
More revealing is what the numbers actually show. Media headlines will anchor on "1.4 million websites targeted," but the truth is more selective: the Joomla exploit hit 560,000 targets and succeeded on 77. The Breeze plugin exploit, their most effective vector, worked on only 17,000 of 45,000 attempts. This gap is not a failure—it's a business model. Webshell access brokerages profit on volume, not precision. They spray exploits across vast surfaces, accept single-digit success rates, and rely on the absolute number of compromises to sustain the operation.
The urgency here is not novel vulnerability response but patch debt accountability. Every compromised site in this operation ran a known, patched vulnerability. Site owners had warnings, CVE advisories, one-click update buttons, and automated reminders. They chose not to use them. Organizations hosting WordPress or Joomla now need to inventory their plugin versions against this operation's toolkit, not just patch going forward. Stale installations are criminal infrastructure—they've already been backdoored. The question is whether defenders will find and remove those backdoors before the access brokers do.
— HackWire Editorial
## Related Coverage