2026-08-19 · view entry permalink →
StopAndProtect runs its whole operation off other people's WordPress sites — a must-use plugin that never appears in the plugin list, a hidden REST route that accepts PHP, and an installer that deletes itself
Check Point Research published its analysis of StopAndProtect on 2026-08-18, an operation it had been tracking since it "first noticed a ransomware family called StopAndProtect in the middle of May 2026" (Check Point Research, 2026-08-18). The name originally applied only to the encryption component and was extended to the whole operation because encryption is not the universal outcome — many victims are only quietly mined for data. The structural point, and the reason this matters to organisations that are not themselves targets, is where the operation lives: payload hosting, command-and-control and stolen-data collection all run on compromised WordPress sites rather than on infrastructure the operators own.
The persistence mechanism is the part worth acting on, because it is chosen specifically to defeat the review an administrator would actually perform. Check Point recovered an installer from one hijacked server which, on activation, writes a must-use plugin to wp-content/mu-plugins/wp-sec.php. Files in that directory load automatically on every request, and — the property that matters — "They do not appear/manage like normal plugins in the standard Plugins UI" (Check Point Research, 2026-08-18). The planted plugin registers a hidden REST route, wp-sec/v1/upload; "It authenticates with hardcoded credentials" and "It lets anyone who knows valid credentials upload files to almost any path under the WordPress root", explicitly including .php files (Check Point Research, 2026-08-18). The installer then deactivates and deletes itself. What remains is a file in a directory nobody browses, reachable by anyone holding a static credential, that will write executable code anywhere on the site.
Delivery to end users is the now-familiar paste-and-run pattern: a fake verification page on a hijacked site logs the visitor and puts a PowerShell command on the clipboard for the victim to run themselves, and Check Point records that "the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command" (Check Point Research, 2026-08-18). Two PowerShell stages lead to a base64-encoded .NET assembly that is decoded and loaded in memory, and each .NET stage reaches the next by reflectively enumerating the loaded assembly's types for a static, parameterless method of a fixed name and invoking it — a generic in-memory hand-off repeated at every stage, so nothing after the first command touches disk as an executable. The final component set covers encryption (with per-file keys derived from a password and machine-name pair the operator embeds in the renamed file), an SMB and removable-media worm, a Visual Basic script spreader that moves laterally by creating processes remotely through Windows management interfaces, a lock screen carrying the ransom note, a collector that keylogs, lists files, harvests messaging contacts through interface automation and screenshots the desktop at half-minute intervals while the victim is active, and a bespoke victim-to-operator chat utility.
The scale estimate comes from the operators' own mistake. Check Point assesses that the operator infected their own machine and uploaded desktop files to the collection server, which yielded the source of a fleet-management tool used to toggle the lure across the estate, and "It also contains a few text files listing close to 2,000 compromised WordPress domains, giving us a hint about the size of the operation" (Check Point Research, 2026-08-18). A separate exposed directory held roughly 700 stolen-data archives and about 31,000 victim screenshots gathered between mid-May and the end of July 2026. Log analysis as of 24 July 2026 indicates more than 6,000 unique victim addresses, distributed most heavily across the United States and then Russia and India in a table Check Point publishes; the lab qualifies this as partial, noting sandbox and researcher traffic in the data and that one server's log had been reset more than once.
On how the WordPress sites themselves were taken, Check Point makes no claim beyond an observation that "There are many vulnerable WordPress websites simply because their owners do not keep them updated" (Check Point Research, 2026-08-18), illustrated by one compromised site found running a five-year-old WordPress core with around forty identifiable issues. No CVE, no credential-theft finding, no actor name and no lineage to any previously tracked operation are offered, and none is asserted here.
We first noticed a ransomware family called StopAndProtect in the middle of May 2026.
It authenticates with hardcoded credentials.
It lets anyone who knows valid credentials upload files to almost any path under the WordPress root.
They do not appear/manage like normal plugins in the standard Plugins UI.
There are many vulnerable WordPress websites simply because their owners do not keep them updated.
It also contains a few text files listing close to 2,000 compromised WordPress domains, giving us a hint about the size of the operation.