EssentialPlugin WordPress Supply Chain Compromise — Ethereum C2 Backdoor in 31 Plugins Affecting 400K+ Installations

Key facts

Detection coverage

As of 2026-04-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0371 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TeamPCP Post-Exploitation — Credential Harvesting via Process Memory & Encryption Staging

Detects TeamPCP post-exploitation credential harvesting activities including GitHub Actions Runner.Worker process memory extraction via /proc/pid/mem (bypasses GitHub secret masking), AES-256-CBC encryption of staged credential archives, Kubernetes secret bulk enumeration via kubectl, and CanisterWorm process masquerading as systemd or pgmon from non-standard paths.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1552.001, T1005, T1528, T1074.001, T1036
• Data sources: sysmon, linux_auditd, kubernetes_audit
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*pgrep*Runner.Worker*" OR (CommandLine="*/proc/*" CommandLine="*/mem*") OR (CommandLine="*openssl*" CommandLine="*enc*" CommandLine="*aes-256-cbc*") OR (CommandLine="*kubectl*" CommandLine="*get secrets*" CommandLine="*--all-namespaces*") OR (Image="*/tmp/*systemd" OR Image="*/tmp/*pgmon")) | eval attack_stage=case(match(CommandLine, "pgrep.*Runner\\.Worker|/proc/.*/mem"), "proc_mem_credential_extraction", match(CommandLine, "openssl.*enc.*aes-256-cbc"), "credential_encryption_staging", match(CommandLine, "kubectl.*get secrets.*all-namespaces"), "kubernetes_secret_enumeration", match(Image, "/tmp/.*(?:systemd|pgmon)"), "process_masquerading", true(), "unknown") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(Image) as images by Computer, User, ParentImage, attack_stage | table Computer, User, attack_stage, commands, images, ParentImage, first_seen, last_seen, count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "pgrep" and ProcessCommandLine has "Runner.Worker"
    or (ProcessCommandLine has "/proc/" and ProcessCommandLine has "/mem")
    or (ProcessCommandLine has "openssl" and ProcessCommandLine has "enc" and ProcessCommandLine has "aes-256-cbc")
    or (ProcessCommandLine has "kubectl" and ProcessCommandLine has "get secrets" and ProcessCommandLine has "--all-namespaces")
    or (FileName in~ ("systemd", "pgmon") and FolderPath startswith "/tmp/")
| extend AttackStage = case(
    ProcessCommandLine has "Runner.Worker" or (ProcessCommandLine has "/proc/" and ProcessCommandLine has "/mem"), "proc_mem_credential_extraction",
    ProcessCommandLine has "openssl" and ProcessCommandLine has "aes-256-cbc", "credential_encryption_staging",
    ProcessCommandLine has "kubectl" and ProcessCommandLine has "get secrets", "kubernetes_secret_enumeration",
    FileName in~ ("systemd", "pgmon"), "process_masquerading",
    "unknown"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, AttackStage, InitiatingProcessFileName

Sigma

title: TeamPCP Post-Exploitation — Credential Harvesting via Process Memory & Encryption Staging
id: d4e5f6a7-0371-4102-9002-aabbccddee02
status: experimental
description: Detects TeamPCP post-exploitation including Runner.Worker /proc/mem credential extraction, AES-256-CBC credential encryption staging, Kubernetes secret enumeration, and CanisterWorm process masquerading
references:
    - https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/
    - https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild
author: Threadlinqs Team
date: 2026/04/15
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1005
    - attack.t1528
    - attack.collection
    - attack.t1074.001
    - attack.defense_evasion
    - attack.t1036
    - cve.2026.33634
logsource:
    product: linux
    category: process_creation
detection:
    selection_procmem_pgrep:
        CommandLine|contains: 'pgrep -f Runner.Worker'
    selection_procmem_read:
        CommandLine|contains|all:
            - '/proc/'
            - '/mem'
    selection_openssl:
        CommandLine|contains|all:
            - 'openssl'
            - 'enc'
            - 'aes-256-cbc'
    selection_kubectl:
        CommandLine|contains|all:
            - 'kubectl'
            - 'get secrets'
            - '--all-namespaces'
    selection_masquerade:
        Image|endswith:
            - '/systemd'
            - '/pgmon'
    filter_legit_paths:
        Image|startswith:
            - '/usr/lib/systemd/'
            - '/lib/systemd/'
            - '/usr/pgsql'
            - '/usr/bin/'
    condition: selection_procmem_pgrep or selection_procmem_read or selection_openssl or selection_kubectl or (selection_masquerade and not filter_legit_paths)
falsepositives:
    - Legitimate CI/CD runner debugging accessing process memory
    - Authorized file encryption using openssl aes-256-cbc
    - Kubernetes administrators performing security audits of secrets
    - Custom-compiled systemd or PostgreSQL in non-standard paths
level: high

Known false positives:

• Legitimate CI/CD runner debugging accessing process memory
• Authorized file encryption operations using openssl aes-256-cbc
• Kubernetes administrators performing authorized security audits of cluster secrets
• Custom-compiled systemd or PostgreSQL installations in non-standard paths

Tuning notes: Exclude known CI/CD debugging accounts from proc/mem alerts. Whitelist authorized openssl encryption scripts by parent process. Restrict kubectl secrets alert to non-admin service accounts. Baseline legitimate systemd/pgmon binary paths per environment.

• 🔒 TeamPCP Supply Chain Exploitation — Compromised Package Installation & Malicious Payload Execution · unlock with TL Creds
• 🔒 TeamPCP Post-Exploitation — Bulk AWS API Reconnaissance & Cloud Credential Abuse · unlock with TL Creds
• 🔒 TeamPCP C2/Lateral Movement — ECS Exec Container Access & Credential Validation Tools · unlock with TL Creds
• 🔒 TeamPCP Supply Chain Exploitation — GitHub Actions Tag Poisoning & Force-Push Detection · unlock with TL Creds
• 🔒 TeamPCP Post-Exploitation — Privileged Kubernetes DaemonSet Deployment & Wiper Indicators · unlock with TL Creds
• 🔒 TeamPCP C2/Lateral Movement — DNS-Based C2 Detection & Encrypted Exfiltration Archive · unlock with TL Creds
• 🔒 TeamPCP Supply Chain Exploitation — WAV Steganography & Malicious Persistence Artifacts · unlock with TL Creds
• 🔒 TeamPCP C2 Communication — ICP Canister, Cloudflare Tunnel & Known Infrastructure IOCs · unlock with TL Creds

Indicators of compromise

As of 2026-04-15, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-0371.

Sample indicators (1 of 23)

• Domain: essentialplugin[.]com

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

Technical analysis

The malware uses Ethereum smart contract-based C2 address resolution to evade traditional domain takedowns.

In one of the most sophisticated WordPress supply chain attacks documented to date, a threat actor operating under the alias 'Kris' acquired the entire Essential Plugin portfolio — 31 free WordPress plugins with premium versions — through the Flippa digital marketplace in mid-2025 for a six-figure sum. The Essential Plugin suite, originally built by Minesh Shah, Anoop Ranawat, and Pratik Jain under the 'WP Online Support' brand starting around 2015 and rebranded in August 2021, had accumulated over 400,000 total installations and 15,000+ customers across its product line.

On August 8, 2025, the new owner pushed version 2.6.7 across all 31 plugins. The changelog innocuously claimed 'Check compatibility with WordPress version 6.8.2,' but the update injected 191 lines of backdoor code into the plugins' existing wpos-analytics module. The backdoor consisted of three malicious components: (1) a fetch_ver_info() method that calls file_get_contents() on the attacker's server and passes the response through PHP's @unserialize() function, enabling arbitrary code execution; (2) a version_info_clean() method that executes @$clean($this->version_cache, $this->changelog), a dynamic function call allowing arbitrary code execution; and (3) an unauthenticated WordPress REST API endpoint registered with permission_callback set to __return_true, exposing the backdoor functionality to any remote caller without authentication.

The backdoor remained dormant for approximately 8 months. On April 5-6, 2026, it was activated. The injection window on April 6 lasted exactly 6 hours and 44 minutes (04:22-11:06 UTC). During this window, the command-and-control domain analytics.essentialplugin.com began distributing payloads to every website running a compromised plugin. The malware downloaded a file named wp-comments-posts.php — deliberately mimicking the legitimate WordPress core file wp-comments-post.php — and used it to inject approximately 6KB of PHP code into wp-config.php, one of WordPress's most sensitive configuration files. The injection was placed on the same line as the require_once ABSPATH . wp-settings.php statement, ensuring the malicious code executed on every single page load.

The injected code implemented a sophisticated SEO spam cloaking operation. It fetched spam links, redirects, and fake pages from the C2 server but only displayed them to Googlebot, making the compromise invisible to site administrators and regular visitors. This black-hat SEO technique was designed to manipulate search rankings while evading human detection for as long as possible.

Notably, the malware employed Ethereum smart contract-based C2 address resolution — a technique known as EtherHiding. Rather than relying on traditional DNS for C2 resolution, the backdoor queried public blockchain RPC endpoints to resolve the current C2 server address from a smart contract. This made traditional domain takedowns ineffective because the attacker could update the smart contract to point to a new domain at any time, without re-infecting any compromised sites. The blockchain's immutable, censorship-resistant architecture means no single entity can delete the resolution records.

On April 7, 2026, the WordPress.org Plugins Team permanently closed all 31 plugins from the 'essentialplugin' author. On April 8, a forced auto-update to version 2.6.9.1 was pushed across all affected sites. This update added return statements and commented out the @$clean() backdoor line. However, critically, the forced update could NOT clean already-infected wp-config.php files or remove the wp-comments-posts.php webshell, leaving affected sites still compromised and requiring manual remediation. The C2 endpoint analytics.essentialplugin.com was subsequently shut down and now returns {"message":"closed"}.

Austin Ginder, founder of Anchor Hosting, discovered and documented the compromise using backup forensics. He employed restic snapshots to compare wp-config.php file sizes across dates, using binary search methodology to narrow the injection window. PatchStack, a WordPress security platform, provided additional analysis. WHOIS records for essentialplugin.com were updated on August 30, 2025 to 'Kim Schmidt' in Zurich, Switzerland, using a ProtonMail email address — likely a pseudonymous registration.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1480 Execution Guardrails

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

Impact

T1491 Defacement; T1565 Data Manipulation

Persistence

T1505 Server Software Component; T1546 Event Triggered Execution; T1554 Compromise Host Software Binary

Resource Development

T1584 Compromise Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities

Remediation

Patches

• WordPress.org forced auto-update to v2.6.9.1 (April 8, 2026) — adds return statements and comments out @$clean() backdoor
• v2.6.9.1 does NOT clean infected wp-config.php or remove wp-comments-posts.php webshell — manual cleanup required

Immediate actions

• Remove ALL Essential Plugin products from WordPress installations immediately
• Search for and delete wp-comments-posts.php in WordPress root directory
• Inspect wp-config.php for injected code — look for ~6KB of extra PHP on the require_once ABSPATH line
• Restore wp-config.php from a clean backup dated before April 5, 2026
• Block analytics.essentialplugin.com at firewall/WAF level
• Scan all WordPress files for additional backdoors planted during compromise window
• Check Google Search Console for unexpected indexed spam pages
• Force re-crawl in Google Search Console to remove injected spam

Workarounds

• Replace affected plugins with trusted alternatives from different authors
• Restore wp-config.php from clean backup pre-dating April 5, 2026
• Delete wp-comments-posts.php webshell manually
• Review and clean database for any injected content or rogue admin accounts

Longer-term hardening

• Implement outbound connection whitelisting for WordPress servers
• Deploy WAF with WordPress-specific rule sets
• Monitor WordPress plugin ownership changes and suspicious updates
• Audit all third-party plugins for supply chain risk before deployment
• Implement file integrity monitoring on wp-config.php and WordPress core files
• Use WordPress security plugins with real-time file change detection
• Subscribe to WordPress security advisory feeds (PatchStack, Wordfence)

Affected and fixed versions

• Essential Plugin (formerly WP Online Support) — accordion-and-accordion-slider
  Vulnerable versions: 2.6.7 through 2.6.9
  Fixed in: 2.6.9.1 (partial — manual cleanup still required)
• Essential Plugin — album-and-image-gallery-plus-lightbox
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — audio-player-with-playlist-ultimate
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — blog-designer-for-post-and-widget
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — countdown-timer-ultimate
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — featured-post-creative
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — footer-mega-grid-columns
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — hero-banner-ultimate
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — html5-videogallery-plus-player
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)
• Essential Plugin — meta-slider-and-carousel-with-lightbox
  Vulnerable versions: 2.6.7+
  Fixed in: 2.6.9.1 (partial)

Timeline

• 2015-01-01 Minesh Shah, Anoop Ranawat, and Pratik Jain establish WP Online Support and begin developing WordPress plugins
• 2021-08-01 WP Online Support rebrands to Essential Plugin, consolidating 30+ WordPress plugins under the new identity
• 2025-05-12 New WordPress.org account created by the buyer in preparation for plugin takeover
• 2025-05-14 Original Essential Plugin developers (Minesh Shah, Anoop Ranawat, Pratik Jain) make their last commits to the plugin repositories
• 2025-07-01 Flippa publishes case study on the six-figure acquisition of the Essential Plugin portfolio by buyer alias 'Kris'
• 2025-08-08 Version 2.6.7 released across all 31 plugins — contains 191 lines of backdoor code in wpos-analytics module disguised as WordPress 6.8.2 compatibility check
• 2025-08-30 WHOIS records for locked-ioc-3 updated to 'Kim Schmidt', Zurich, Switzerland with ProtonMail contact email
• 2026-04-05 Dormant backdoor activated after 8 months — C2 domain locked-ioc-1 begins serving malicious payloads
• 2026-04-06 Primary injection window: 04:22-11:06 UTC (6 hours 44 minutes) — locked-ioc-2 webshells deployed and wp-config.php files injected with ~6KB of SEO spam cloaking code
• 2026-04-07 WordPress.org Plugins Team permanently closes all 31 plugins from the 'essentialplugin' author — plugins will never be updated again
• 2026-04-08 WordPress.org pushes forced auto-update to v2.6.9.1 which adds return statements and comments out @$clean() backdoor line — does NOT clean infected wp-config.php or remove webshell
• 2026-04-14 Austin Ginder (Anchor Hosting) publishes comprehensive forensic analysis of the supply chain compromise using backup forensics and binary search methodology
• 2026-04-15 Major media coverage from BleepingComputer, TechCrunch, The Next Web — C2 endpoint locked-ioc-1 now returns {"message":"closed"}
• 2026-05-29 As of 2026-05-29, the backdoor is contained at the source (all 31 plugins closed Apr 7, forced v2.6.9.1 Apr 8, C2 dead, WordPress.com cleaned 2,200+ sites by May 21) but NOT resolved: forced update can't clean infected wp-config.php/webshells so un-remediated sites stay compromised, the actor (Kris/Kim Schmidt) is unidentified/at large, and CVE-2026-6443 has no vendor patch (untrusted author account). EtherHiding C2 can be re-pointed anytime, keeping it a live concern.

Sources cited

• WordPress.org Plugins Team: Warning — Essential Plugin Author Compromise wordpress.org · Advisory · 2026-04-10
• Austin Ginder (Anchor Hosting): Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them anchor.host · Research · 2026-04-14
• Picus Security: EtherHiding — How Web3 Infrastructure Enables Stealthy Malware Distribution picussecurity.com · Research · 2026-04-15
• Google Cloud Threat Intelligence: DPRK Adopts EtherHiding — Nation-State Malware Hiding on Blockchains Google Cloud · Research · 2026-04-15
• mySites.guru: Essential Plugin WordPress Backdoor Analysis mysites.guru · Blog · 2026-04-15
• BleepingComputer: WordPress plugin suite hacked to push malware to thousands of sites BleepingComputer · News · 2026-04-15
• TechCrunch: Someone planted backdoors in dozens of WordPress plugins used in thousands of websites techcrunch.com · News · 2026-04-14
• The Next Web: 30+ WordPress plugins bought on Flippa and backdoored in supply chain attack thenextweb.com · News · 2026-04-15
• TechNadu: WordPress Plugin Backdoor Exposes Thousands of Sites technadu.com · News · 2026-04-15
• TechBriefly: Dozens of WordPress plug-ins go offline after backdoor discovered techbriefly.com · News · 2026-04-15

Related threats

• ShapedPlugin WordPress Pro Plugins Backdoored via Build-Pipeline Supply Chain Compromise (CVE-2026-49777, CVE-2026-10735)
• Smart Slider 3 Pro Supply Chain Compromise — Malicious WordPress and Joomla Plugin Updates with Multi-Layered Backdoors (v3.5.1.35)

Previous and next in supply chain

• Axios npm Supply Chain Compromise — Malicious axios@1.14.1 and axios@0.30.4 Inject plain-crypto-js@4.2.1 RAT Dropper Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages