Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites A cybercrime crew left one of its own servers wide open on the internet for three weeks, and it exposed the operation's inner workings: the hacking tools, the activity logs, and target lists naming more than 1.4 million websites. Far fewer were actually broken into, but the exposed files showed researchers how a mass site-hacking operation runs from the inside. The operation, now tracked as …

https://thehackernews.com/2026/07/exposed-hacker-server-reveals-wp.html

sha256:15bd69214631e967e62a62fbfba759699688a0361e7fd8c2c12f228a69076e8e

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve15
md50
url0
ipv43
ipv60
sha10
domain6
sha2560
malware_token1
attack_pattern0
threat_actor_token2

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
cve	CVE-2026-46817	Open →
cve	CVE-2026-55200	Open →
ip	137.175.93.126	Open →
ip	43.108.17.80	Open →
domain	hunt.io	Open →
domain	down.php	Open →
domain

Malware families

Allowlist token matches only.

Metasploitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports