website defacement | Breaking Cybersecurity News | The Hacker News

Cybersecurity researchers have uncovered a new stealthy backdoor concealed within the "mu-plugins" directory in WordPress sites to grant threat actors persistent access and allow them to perform arbitrary actions. Must-use plugins (aka mu-plugins) are special plugins that are automatically activated on all WordPress sites in the installation. They are located in the "wp-content/mu-plugins" directory by default. What makes them an attractive option for attackers is that mu-plugins do not show in the default list of plugins on the Plugins page of wp-admin and cannot be disabled except by removing the plugin file from the must-use directory. As a result, a piece of malware that leverages this technique allows it to function quietly, without raising any red flags. In the infection spotted by web security company Sucuri, the PHP script in the mu-plugins directory ("wp-index.php") serves as a loader to fetch a next-stage payload and save it in the WordPr...

No fewer than 70 websites operated by the Ukrainian government went offline on Friday for hours in what appears to be a coordinated cyber attack amid heightened tensions with Russia. "As a result of a massive cyber attack, the websites of the Ministry of Foreign Affairs and a number of other government agencies are temporarily down," Oleg Nikolenko, MFA spokesperson,  tweeted . The Security Service of Ukraine, the country's law-enforcement authority,  alluded  to a possible Russian involvement, pointing fingers at the hacker groups associated with the Russian secret services while branding the intrusions as a supply chain attack that involved hacking the "infrastructure of a commercial company that had access to the rights to administer the web resources affected by the attack." Prior to the update from the SSU, the Ukrainian CERT claimed that the attacks may have exploited a security vulnerability in Laravel-based October CMS ( CVE-2021-32648 ), which cou...

The US Department of Justice (DoJ) on Tuesday indicted two hackers for their alleged involvement in defacing several websites in the country following the assassination of Iranian major general Qasem Soleimani earlier this January. Behzad Mohammadzadeh (aka Mrb3hz4d), 19, and Marwan Abusrour (aka Mrwn007), 25, have been charged with conspiracy to commit intentional damage to a protected computer for a widespread "cyber-assault" that affected over 1,400 websites with pro-Iranian and pro-Palestinian messages. "The hackers victimized innocent third parties in a campaign to retaliate for the military action that killed Soleimani, a man behind countless acts of terror against Americans and others that the Iranian regime opposed," said Assistant Attorney General for National Security John C. Demers in a statement. The defendants, from Iran and Palestine, respectively, are now wanted by the US authorities and are no longer free to travel outside their countries wi...

It's one thing for hackers to target websites and proudly announce it on social media platforms for all to see. It's, however, an entirely different thing to leave a digital trail that leads cybersecurity researchers right to their doorsteps. That's exactly what happened in the case of a hacktivist under the name of VandaTheGod, who has been attributed to a series of attacks on government websites since July 2019. In a report shared with The Hacker News, researchers from Check Point said they were able to map VandaTheGod's activity over the years, and eventually zero down the attacker's real identity to a Brazilian individual from the city of Uberlândia. The cybersecurity firm said it notified concerned law enforcement of its findings for further action, adding the social media activities on profiles associated with VandaTheGod came to a halt towards the end of 2019. A Long Social Media Trail VandaTheGod has a long history of going after government we...

Matrix—the organization behind an open source project that offers a protocol for secure and decentralized real-time communication—has suffered a massive cyber attack after unknown attackers gained access to the servers hosting its official website and data. Hackers defaced Matrix's website, and also stole unencrypted private messages, password hashes, access tokens, as well as GPG keys the project maintainers used for signing packages. The cyber attack eventually forced the organization to shut down its entire production infrastructure for several hours and log all users out of Matrix.org. So, if you have an account with Matrix.org service and do not have backups of your encryption keys or were not using server-side encryption key backup, unfortunately, you will not be able to read your entire encrypted conversation history. Matrix is an open source end-to-end encrypted messaging protocol that allows anyone to self-host a messaging service on their own servers, powering ...

OurMine is in headlines once again—this time for defacing WikiLeaks website. The notorious hacking group, OurMine, is known for breaching into high-profile figures and companies' social media accounts, including Facebook CEO Mark Zuckerberg , Twitter CEO Jack Dorsey , Google CEO Sundar Pichai , HBO , Game of Thrones and Sony's PlayStation Network (PSN). According to screenshots circulating on Twitter , the official website of WikiLeaks has reportedly been defaced by the OurMine hacking group, who left a message on the site, as shown above. WikiLeaks is a whistleblowing website that since March, has been revealing top CIA hacking secrets under Vault 7 , including the agency's ability to break into different mobile and desktop platforms , security camera live video streams , air-gap computers and many more. There is no indication of WikiLeaks servers and website been compromised, instead it seems their website has been redirected to a hacker-controlled server ...

During the 2016 presidential election campaign, we reported about how insecure was the mail servers operated by the Trump organization that anyone with little knowledge of computers can expose almost everything about Trump and his campaign. Now, some unknown hackers calling themselves "Pro_Mast3r" managed to deface an official website associated with President Donald Trump's presidential campaign fundraising on Sunday. The hacker, claiming to be from Iraq, reportedly defaced the server, secure2.donaldjtrump.com, which is behind CloudFlare's content management system and security platform. The server appears to be an official Trump campaign server, reported Ars, as the certificate of the server is legitimate, " but a reference to an image on another site is insecure, prompting a warning on Chrome and Firefox that the connection is not secure. " The defaced website displayed an image of a black hat man and included a text message, which reads: Ha...

In a troubling trend of tit-for-tat website defacements, a group of Indian hackers known as the 'Indian Cyber Army' hacked the Oil & Gas Regulatory Authority (OGRA) website [ www.ogra.org.pk ] on Saturday. The website was later restored by the site administrators. The message left on the OGRA page stated that the hack was in response to an attack on over 200 Indian websites by the 'Pakistan Cyber Army'. The message read: "You Have Been Hacked By The 'INDIAN CYBER ARMY'. This Is a Retaliation Of Hacking 'CBI'." Previously, a group of Pakistani hackers, identifying themselves as 'Predators PK,' had hacked over 200 Indian websites. This attack was a form of retaliation for a recent cyber assault on Pakistani sites carried out by the Indian Cyber Army (ICA). Unlike the ICA attack, which was cited as 'revenge for 26/11', the message inserted by the Pakistani hackers did not suggest ideological motivations, but rat...