Threat Actor Profile

Storm-1811

G1046

▲ High Threat

WordPress Ecosystem Mass Exploitation, Automated Credential Harvesting Campaign

Origin —

Motivation Financial gain through credential theft, website hijacking, and the exploitation of web assets for secondary monetization.

Target Sectors

WordPress-based websites Small-to-medium businesses (SMBs) E-commerce platforms Web hosting services

Credential stuffing

Exploitation of known vulnerabilities (CVEs)

Automated vulnerability scanning

Exploitation of WordPress plugins

Malicious content injection

Brute-force attacks

CISA Advisories ↗

Hacking the mainframe…