BUY GENUINE PLUGINS AND STOP F****** PIRATE NULLED COPIES!"

[Viking4s]

Hi guys,

I only download from Babiato and from approved threads and trusted uploads but today I got my website hacked and this is what I got. see the screenshot yourself.

Please note that all plugins and themes were deleted from that website, not from the rest of the directory!!

Did anyone experience this please share and I can send a backup of the plugins and themes as well as the link to where I got them from here.

Looking forward to hearing back from you all

PS, I had Wordfence installed and I got 2 emails.

[Wordfence Alert] www.xxxxx.com Wordfence Deactivated

This email was sent from your website "xxxxxx" by the Wordfence plugin at Thursday 12th of January 2023 at 06:24:07 PM
The Wordfence administrative URL for this site is: xxxxx
A user with username "admin" deactivated Wordfence on your WordPress site.
User IP: 104.244.227.213
User hostname: 104.244.227.213
User location: Kingston, Jamaica

 

[slvrsteele]

This looks more like a developer included a backdoor in his plugin/theme. It has nothing to do with nulling. You need to find which plugin from your list has the backdoor

 

[sadewa]

This developer backdor in plugin,

 

[DatDudeUpStairs]

Hi guys,

I only download from Babiato and from approved threads and trusted uploads but today I got my website hacked and this is what I got. see the screenshot yourself.

Please note that all plugins and themes were deleted from that website, not from the rest of the directory!!

Did anyone experience this please share and I can send a backup of the plugins and themes as well as the link to where I got them from here.

Looking forward to hearing back from you all

PS, I had Wordfence installed and I got 2 emails.

[Wordfence Alert] www.xxxxx.com Wordfence Deactivated

This email was sent from your website "xxxxxx" by the Wordfence plugin at Thursday 12th of January 2023 at 06:24:07 PM
The Wordfence administrative URL for this site is: xxxxx
A user with the username "admin" deactivated Wordfence on your WordPress site.
User IP: 104.244.227.213
User hostname: 104.244.227.213
User location: Kingston, Jamaica

Of course, you should not use nulled files for a working site.
The Question? What is the philosophy behind the nulled communities?
The answer: So the users can find what they are looking for and if their desired scripts or plugins have what it takes to elevate their website to a whole new level.
Some want to take the risk, but it's always advised to use the original files with a valid license.
Many developers plant backdoors in their plugins and scripts to f..k over the pirates.

 

[Viking4s]

Hi guys, I really appreciate it as this is the first time this happened to me and it's freaking me out!

Here's a copy of all the plugins that I have at that time and I am using HUB theme.

Spoiler

https://file.io/82C8TnNBADeu

Would appreciate it if you guys can tell me which plugin had the backdoor and how to delete backdoor so I won't have to face this problem again!

Also quick question, should I change the password of the cpanel and website now?

If a developer can do the backdoor and sell it on codecanyon or themeforst that means spying on others which is not good and an action needs to be taken, don't you guys agree?

Looking forward to hearing back from you all

Best Regards

 

[Viking4s]

@slvrsteele @DatDudeUpStairs @Babak

The new download link

Spoiler

aioseo-image-seo.zip

drive.google.com

 

[Viking4s]

Sydney, New South Wales, Australia was blocked by firewall for Known malicious User-Agents at https://xxxxxx.com/ALFA_DATA/alfacgiapi/perl.alfa 1/12/2023 10:53:47 AM (22 hours 48 mins ago) IP: 20.92.225.14 Hostname: 20.92.225.14 Human/Bot: Bot Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36

Do you guys know something about ALFA_DATA/alfacgiapi/perl.alfa?

 

[drakus]

Sydney, New South Wales, Australia was blocked by firewall for Known malicious User-Agents at https://xxxxxx.com/ALFA_DATA/alfacgiapi/perl.alfa 1/12/2023 10:53:47 AM (22 hours 48 mins ago) IP: 20.92.225.14 Hostname: 20.92.225.14 Human/Bot: Bot Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36

Do you guys know something about ALFA_DATA/alfacgiapi/perl.alfa?

That is a bot that scans WP sites for vulnerabilities.

 

[sadewa]

This is dork ALFA_DATA/alfacgiapi/perl.alfa for deface methods perl alfa,..

 

[Viking4s]

This is dork ALFA_DATA/alfacgiapi/perl.alfa for deface methods perl alfa,..

How to stop the attack like this?

 

[sadewa]

How to stop the attack like this?

Patch file pearl.alfa,,,

 

[Viking4s]

Patch file pearl.alfa,,,

Please how?

 

[Viking4s]

Bingo! I figure out why I was hacked. It was vulnerability in LiteSpeed Cache plugin!

I have attached a picture of the hacker leaving a message on website that uses "LiteSpeed Cache".

In less than 10 hours 2 website were hacked and left with that message and maybe more.

Mine and ssuaych.org! How do I know? I did scan plugins for ssuaych.org and they are only using LiteSpeed Cache along with other plugins and what we have in common? Just one plugin and it's LiteSpeed Cache.

I have deactivated it and deleted it.

You can all check the following article:

Word-press plugin lightspeed caches security flaws and how to exploit them | Briskinfosec

Stay ahead of potential security threats with our in-depth analysis of the security vulnerabilities in the popular Wordpress plugin, LightSpeed Cache. Learn how attackers may exploit these flaws and how to protect your website from potential hacking attempts.

www.briskinfosec.com

So it wasn't the plugin I downloaded from here it was the goddamn LiteSpeed Cache.

Any thoughts?

 

[sadewa]

Bingo! I figure out why I was hacked. It was vulnerability in LiteSpeed Cache plugin!

I have attached a picture of the hacker leaving a message on website that uses "LiteSpeed Cache".

In less than 10 hours 2 website were hacked and left with that message and maybe more.

Mine and ssuaych.org! How do I know? I did scan plugins for ssuaych.org and they are only using LiteSpeed Cache along with other plugins and what we have in common? Just one plugin and it's LiteSpeed Cache.

I have deactivated it and deleted it.

You can all check the following article:

Word-press plugin lightspeed caches security flaws and how to exploit them | Briskinfosec

Stay ahead of potential security threats with our in-depth analysis of the security vulnerabilities in the popular Wordpress plugin, LightSpeed Cache. Learn how attackers may exploit these flaws and how to protect your website from potential hacking attempts.

www.briskinfosec.com

So it wasn't the plugin I downloaded from here it was the goddamn LiteSpeed Cache.

Any thoughts?

Good job bro,, thanks for share,,

Not understand to internal server u,, sorry no help u..

 

[drakus]

Been running litespeed with cache plugin for years and never a problem.
are you not running any security plugin like wordfence?

 

[GodDevil]

Bingo! I figure out why I was hacked. It was vulnerability in LiteSpeed Cache plugin!

Any thoughts?

Litespeed is a free plugin... so it cannot be the Litespeed but something else.

 

[Viking4s]

Here's why this happened guys! from my hosting support team!

 

[montego]

Hi guys,

I only download from Babiato and from approved threads and trusted uploads but today I got my website hacked and this is what I got. see the screenshot yourself.

Please note that all plugins and themes were deleted from that website, not from the rest of the directory!!

Did anyone experience this please share and I can send a backup of the plugins and themes as well as the link to where I got them from here.

Looking forward to hearing back from you all

PS, I had Wordfence installed and I got 2 emails.

[Wordfence Alert] www.xxxxx.com Wordfence Deactivated

This email was sent from your website "xxxxxx" by the Wordfence plugin at Thursday 12th of January 2023 at 06:24:07 PM
The Wordfence administrative URL for this site is: xxxxx
A user with username "admin" deactivated Wordfence on your WordPress site.
User IP: 104.244.227.213
User hostname: 104.244.227.213
User location: Kingston, Jamaica

which plugin did you download?

 

[Viking4s]

which plugin did you download?

Read the comments mate!

 

[GodDevil]

Mine and ssuaych.org! How do I know? I did scan plugins for ssuaych.org and they are only using LiteSpeed Cache along with other plugins and what we have in common? Just one plugin and it's LiteSpeed Cache.

Contact form7 and Google Site Kit plugins are also used by both.