Nearly 2,000 black WordPress sites were used to spread malicious software and deploy extortion software

On 21 August, the Cyber Security company Check Point Research discovered that the StopAndProtec extortion software operation used nearly 2,000 hacked WordPress sites to disseminate malicious software, steal data, monitor victims and deploy extortion software. The operation was discovered in mid-May. As at 24 July, the operation had invaded more than 6000 independent IP addresses, of which the United States had 1852 and Russia and India had 630 each. The website was also used to host malicious software, send instructions and store stolen documents, intercepts and activity logs. The attackers used false CAPTCHA to induce Windows users to run PowerShell commands, stealing vouchers and encrypted currency wallet notes, and spreading through networks and USB devices. Researchers collected more than 31,000 screenshots and over 700 data compressors and believed that the attackers might have infected themselves by mistake。