Overview
A sophisticated ransomware campaign leverages well-structured Python backdoor code to enable network-wide compromise through SOCKS5 proxy tunneling. The attack chain begins with SocGholish malware exploiting vulnerable WordPress SEO plugins with CVE-2024-4984 and CVE-2024-3665
Whom it may concern
- WordPress site administrators
- Network security teams
- Security operations centers monitoring for lateral movement
- Incident response teams handling ransomware
Key Findings
- Initial access via WordPress SEO plugin vulnerabilities with CVSS 6.4
- Highly readable Python backdoor deployed within 20 minutes of compromise
- Lateral movement achieved through RDP sessions and SOCKS5 tunneling
- Multiple pre-ransomware tools including EDRSilencer and MailBruter
Risk Analysis
- Probability: High due to widespread WordPress plugin usage
- Impact: Critical - potential full network encryption
- Detection possible through EDR and network monitoring
- Recovery complicated by 7-day deletion threats
Action Items
- Update WordPress plugins immediately
- Monitor for suspicious Python processes
- Implement RDP restriction policies
- Deploy SOCKS proxy detection capabilities
- Review AWS S3 bucket permissions
Sources
- [The Hacker News](https://thehackernews.com/2025/01/python-based-malware-powers-ransomhub.html)
