WP-SHELLSTORM

WP-SHELLSTORM is a financially motivated cybercrime operation assessed with medium-to-high confidence to be Chinese or Chinese-speaking. The group functions primarily as a webshell access brokerage: it mass-exploits known vulnerabilities in internet-facing web applications, implants covert webshell backdoors on compromised sites, and packages or resells that access. Activity attributed to the operation has centered on large-scale exploitation of WordPress and Joomla ecosystems, with particular success from exploiting CVE-2026-3844 in the Breeze caching plugin. Reporting on the group indicates that its infrastructure, logs, and tooling exposed target lists covering more than 1.4 million websites, although that figure reflected scanned or queued targets rather than confirmed compromises; validated compromise estimates ranged from several thousand active webshells to more than 25,000 deduplicated affected sites. The operation relies on automated scanning and exploitation against publicly known vulnerabilities, including broad use of internet-exposed asset discovery platforms to assemble target lists. Its tooling included exploit scripts, scan results, command history, and command-and-control settings spanning dozens of vulnerabilities across WordPress, Joomla, and other platforms. The group’s principal webshell was an obfuscated implant derived from the Chinese open-source BestShell family. Observed capabilities included remote command execution, file management, reverse shell access, internal network scanning, and identification of security software on compromised hosts. The operators also used the SNOWLIGHT dropper to deploy the VShell backdoor for more persistent remote access, while disguising processes to blend with normal Linux activity. Beyond website compromise, the same operators were linked to an earlier campaign against exposed Nacos systems in which they bypassed authentication and stole configuration files and embedded secrets from corporate environments. Stolen data reportedly included cloud credentials, database passwords, and cryptographic material from organizations in fintech, e-commerce, logistics, gaming, and electronics. This broader activity shows that WP-SHELLSTORM is not limited to simple website defacement or opportunistic shell placement, but is capable of post-compromise credential theft, data exfiltration, and follow-on monetization of access. Although some tooling overlaps with malware and tradecraft seen in Chinese intrusion sets, available evidence supports classification of WP-SHELLSTORM as a criminal operation rather than a state-directed actor. No high-confidence sub-group structure is established from the available facts. Known aliases are limited to WP-SHELLSTORM.