On November 20th Fox IT reported on CryptoPHP. Since publishing Fox IT have, together with other parties, been busy dealing with the affected servers and taking down the CryptoPHP infrastructure.
Sinkhole statistics
With the help of the NCSC, Abuse.ch, Shadowserver and Spamhaus Fox IT has been able to gather data about the scale of the operation ran by the CryptoPHP authors. Most C2 domains that were active at the time of publishing have been either sinkholed or taken down. From the sinkholed domains we’ve been able to gather statistics.
In total 23.693 unique IP addresses connected to the sinkholes. Fox IT are already seeing a decline in sinkhole connections, on the 22nd 20.305 connections were made, on the 23rd 18.994 and on the 24th it was already down to 16.786. These numbers are however not a clear indication, mostly because the servers connecting to our sinkholes were shared hosting with at least 1 or multiple backdoored websites. This means the actual affected websites will be higher. Unfortunately we are also unable to make statistics on whether the affected server is running WordPress, Joomla or Drupal. This information is encrypted using public key encryption as explained in the paper.
A geological map was generated from the sinkhole data, the image below gives an overview of the affected countries.
New Updated information
Since publishing we’ve been keeping an eye on any new developments within CryptoPHP. On the 23rd most of the websites used to spread the backdoored plug-ins and themes went offline, unfortunately they were back up with a new setup a day later and are still active at the time of this publication.
A new version of the backdoor was pushed, although the version number wasn’t changed we did get a new filehash for the backdoor. The SHA1 hash for the file is ‘c4fe641e3410fb047004c9653c79124c32a66446’; the version number is still 1.0.
The updated hash was committed to the github repo with IOCs at:
https://www.github.com/fox-it/cryptophp/
Advice
Fox IT noticed that our advice in our paper wasn’t clear to everyone. Spamhaus received a lot of inquiries about what to do with affected servers or how to find them. For this reason we’ve added this section to explain this a bit better.
Detection
We have created two Python scripts to help administrators detect CryptoPHP:
- check_url.py
- check_filesystem.py
Both scripts can be found on GitHub repo: https://www.github.com/fox-it/cryptophp/scripts/
check_filesystem.py is for scanning the filesystem for the CryptoPHP backdoor files. It will find all “social*.png” files and determine if it’s malicious.
And check_url.py script can scan a website to determine if the website is affected by CryptoPHP. This can be useful if you have multiple virtual hosts and don’t know which one is affected.
Removal
If CryptoPHP has been found we recommend the following steps:
- Remove the “include” of the backdoor. For example, find the script that contains: “<?php include(‘images/social.png’); ?>”. Note that this path can vary.
- Remove the backdoor (social*.png) itself by deleting it.
- Check your database to see if any extra administrator accounts were added and remove them
- Reset the credentials of your own CMS account and other administrators (they were most likely compromised)
The steps above should be sufficient to remove the impact CryptoPHP has had on your website. We do however recommend performing a complete reinstall of your CMS since the system integrity may have been compromised. An attacker may have gained system wide access for example.
For both security and legal reasons we would advise not to install this kind of pirated (nulled) content.
Stay informed and keep up to date with the recommendations of Fox IT
Thanks Fox IT!
