{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Compromised WordPress infrastructure is the engine for ErrTraffic malware distribution. Finding these backdoors early prevents the deployment of ClickFix lures and subsequent infostealer infections."
      },
      "name": "ErrTraffic: WordPress Infrastructure and Backdoor Maintenance",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1078",
        "attack.t1505.003"
      ],
      "series": {
        "slug": "unveiling-errtraffic-a-growing-clickfix-malware-distribution-framework",
        "index": 1,
        "title": "Unveiling ErrTraffic: a growing ClickFix malware distribution framework",
        "total": 2
      },
      "related": [
        {
          "hunt": "errtraffic-malicious-js-injection",
          "reason": "This hunt finds the infrastructure; the next hunt identifies the malicious scripts being served to visitors.",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A rule might catch specific PowerShell payloads, but this hunt correlates successful web-based logins with the subsequent creation of a rare PHP file in sensitive WordPress directories using a fleet-wide prevalence baseline.",
      "coverage": [
        {
          "stage": "initial-access-wordpress-credentials",
          "steps": [
            "wp-login-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-php-backdoors",
          "steps": [
            "rare-php-file-changes"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-malicious-js-injection",
          "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "c2-etherhiding-resolution",
          "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "execution-clickfix-powershell",
          "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-access-infostealer-impact",
          "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "WordPress Credential Abuse",
            "slug": "initial-access-wordpress-credentials",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1078"
            ],
            "observables": [
              "Harvested WordPress credentials used for unauthorized logins"
            ]
          },
          {
            "name": "PHP Backdoor Installation",
            "slug": "persistence-php-backdoors",
            "tactic": "persistence",
            "techniques": [
              "T1505.003"
            ],
            "observables": [
              "Malicious PHP backdoors on WordPress servers",
              "Malicious WordPress plugin facilitating framework deployment"
            ]
          },
          {
            "name": "JavaScript Framework Injection",
            "slug": "execution-malicious-js-injection",
            "tactic": "execution",
            "techniques": [
              "T1059.007"
            ],
            "observables": [
              "Injected scripts referencing /cf.js",
              "Injected scripts referencing /api/css.js",
              "DNS-prefetch for llc-image-ico.click",
              "Base64-encoded and XOR-obfuscated JavaScript"
            ]
          },
          {
            "name": "Blockchain-based C2 Resolution",
            "slug": "c2-etherhiding-resolution",
            "tactic": "command-and-control",
            "techniques": [
              "T1102.001",
              "T1071",
              "T1090.003"
            ],
            "observables": [
              "Polygon blockchain wallet 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308",
              "Quicknode RPC endpoint connections",
              "C2 domains with .beer, .cfd, .club, .click, .cyou, .lat, .sbs, .shop, and .xyz TLDs",
              "RC4 encrypted C2 traffic to /api/index.php"
            ]
          },
          {
            "name": "User-Driven PowerShell Execution",
            "slug": "execution-clickfix-powershell",
            "tactic": "execution",
            "techniques": [
              "T1059.001",
              "T1204.002"
            ],
            "observables": [
              "PowerShell command lines provided via ClickFix lures (fake BSOD, CAPTCHA)",
              "API calls to /api/index.php?a=ctx&os=windows",
              "Clipboard interaction to store malicious commands"
            ]
          },
          {
            "name": "Infostealer Credential Theft",
            "slug": "credential-access-infostealer-impact",
            "tactic": "credential-access",
            "techniques": [
              "T1555",
              "T1115"
            ],
            "observables": [
              "Vidar, Stealc, Remus, and Salat infostealer payloads",
              "Access to browser password storage and clipboard contents"
            ]
          }
        ],
        "summary": "ErrTraffic is a Malware-as-a-Service framework that compromises WordPress sites to inject malicious JavaScript and deploy the ClickFix lure. It utilizes EtherHiding via Polygon smart contracts as a dead-drop resolver for its C2 infrastructure, eventually tricking users into executing PowerShell commands that deliver infostealers like Vidar and Stealc."
      },
      "severity": "high",
      "rationale": "Target systems identified as WordPress servers by hb_software_inventory first. If inventory is missing, broaden scope to all web servers with active PHP processes.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has compromised a WordPress server using harvested credentials and installed a PHP backdoor or malicious plugin to facilitate the delivery of ErrTraffic ClickFix lures.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific hostnames to focus on; leave empty to hunt across the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.sekoia.io/unveiling-errtraffic-inside-a-growing-clickfix-malware-distribution-framework",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.sekoia.io/unveiling-errtraffic-inside-a-growing-clickfix-malware-distribution-framework",
          "name": "Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework"
        }
      ],
      "blind_spots": [
        {
          "id": "incomplete-file-telemetry",
          "risk": "Some Linux servers sample file activity or ignore modifications in core WordPress directories, potentially missing a small PHP script injection.",
          "stage": "persistence-php-backdoors",
          "question": "Did the backdoor installation occur during a high-volume file modification window?",
          "requires": "hb_file_activity on Linux hosting servers"
        },
        {
          "id": "http-logging-depth",
          "risk": "If the web proxy only logs status codes, it may miss successful logins handled via 200 OK responses with internal error messages, leading to false negatives.",
          "stage": "initial-access-wordpress-credentials",
          "question": "Was the login successful based on internal application logic?",
          "requires": "hb_http_activity with full response body"
        }
      ]
    },
    "name": "ErrTraffic: WordPress Infrastructure and Backdoor Maintenance",
    "description": "This hunt focuses on the initial access and persistence phases of the ErrTraffic framework. It identifies servers running WordPress, looks for successful administrative authentications via HTTP POST traffic to login pages, and correlates these with rare file system modifications in sensitive WordPress directories like plugins and themes. The goal is to detect the PHP backdoors used to manage malicious JavaScript injections and ClickFix lures as described in the Sekoia ErrTraffic research."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "unveiling-errtraffic-a-growing-clickfix-malware-distribution-framework",
          "index": 1,
          "title": "Unveiling ErrTraffic: a growing ClickFix malware distribution framework",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-wordpress-credentials",
            "steps": [
              "wp-login-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-php-backdoors",
            "steps": [
              "rare-php-file-changes"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-malicious-js-injection",
            "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "c2-etherhiding-resolution",
            "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "execution-clickfix-powershell",
            "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-access-infostealer-impact",
            "reason": "Belongs to another part of the 'Unveiling ErrTraffic: a growing ClickFix malware distribution framework' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has compromised a WordPress server using harvested credentials and installed a PHP backdoor or malicious plugin to facilitate the delivery of ErrTraffic ClickFix lures.",
        "blind_spots": [
          {
            "id": "incomplete-file-telemetry",
            "risk": "Some Linux servers sample file activity or ignore modifications in core WordPress directories, potentially missing a small PHP script injection.",
            "stage": "persistence-php-backdoors",
            "question": "Did the backdoor installation occur during a high-volume file modification window?",
            "requires": "hb_file_activity on Linux hosting servers"
          },
          {
            "id": "http-logging-depth",
            "risk": "If the web proxy only logs status codes, it may miss successful logins handled via 200 OK responses with internal error messages, leading to false negatives.",
            "stage": "initial-access-wordpress-credentials",
            "question": "Was the login successful based on internal application logic?",
            "requires": "hb_http_activity with full response body"
          }
        ],
        "scoping_notes": "Target systems identified as WordPress servers by hb_software_inventory first. If inventory is missing, broaden scope to all web servers with active PHP processes.",
        "beyond_detection": "A rule might catch specific PowerShell payloads, but this hunt correlates successful web-based logins with the subsequent creation of a rare PHP file in sensitive WordPress directories using a fleet-wide prevalence baseline."
      }
    },
    {
      "id": "identify-wordpress-servers",
      "type": "query",
      "label": "Identify WordPress Servers",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%wordpress%'",
        "surface": "hb_software_inventory",
        "description": "Find every host in the inventory running WordPress software to narrow the hunt scope.",
        "expected_signal": "A list of hostnames acting as WordPress servers. Silence indicates no WordPress installations were detected by the inventory provider."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify WordPress Servers",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "install_path"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%wordpress%'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames acting as WordPress servers. Silence indicates no WordPress installations were detected by the inventory provider.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "wp-login-activity",
      "type": "query",
      "label": "Successful WordPress Web Logins",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "web",
        "content": "SELECT device_hostname, url_path, src_endpoint_ip, user_agent, time FROM hb_http_activity WHERE LOWER(url_path) LIKE '%wp-login.php%' AND http_method = 'POST' AND status_code IN (200, 302) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify successful logins to WordPress via HTTP POST traffic, which may represent the use of harvested credentials.",
        "expected_signal": "Successful POST requests to wp-login.php. A 302 status often indicates a successful redirect to the dashboard."
      },
      "parents": [
        {
          "id": "identify-wordpress-servers"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Successful WordPress Web Logins",
        "reads": [
          "device_hostname",
          "url_path",
          "http_method",
          "status_code",
          "src_endpoint_ip",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_path, src_endpoint_ip, user_agent, time FROM hb_http_activity WHERE LOWER(url_path) LIKE '%wp-login.php%' AND http_method = 'POST' AND status_code IN (200, 302) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Successful POST requests to wp-login.php. A 302 status often indicates a successful redirect to the dashboard.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-php-file-changes",
      "type": "query",
      "label": "Rare PHP File Modifications",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT file_path, file_name, GROUP_CONCAT(DISTINCT device_hostname) AS hosts, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%wp-content/plugins%' OR LOWER(file_path) LIKE '%wp-content/themes%' OR LOWER(file_path) LIKE '%wp-includes%') AND LOWER(file_name) LIKE '%.php' AND activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path, file_name HAVING host_count <= 3",
        "surface": "hb_file_activity",
        "description": "Stack-count PHP file changes in sensitive WordPress directories to find rare backdoors or malicious plugins.",
        "expected_signal": "Rare PHP file modifications in core WordPress directories. Legitimate updates usually touch many hosts; localized changes are suspicious."
      },
      "parents": [
        {
          "id": "identify-wordpress-servers"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare PHP File Modifications",
        "reads": [
          "device_hostname",
          "file_path",
          "file_name",
          "activity_id",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT file_path, file_name, GROUP_CONCAT(DISTINCT device_hostname) AS hosts, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%wp-content/plugins%' OR LOWER(file_path) LIKE '%wp-content/themes%' OR LOWER(file_path) LIKE '%wp-includes%') AND LOWER(file_name) LIKE '%.php' AND activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path, file_name HAVING host_count <= 3",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare PHP file modifications in core WordPress directories. Legitimate updates usually touch many hosts; localized changes are suspicious.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "file_path",
            "file_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-wordpress-compromise",
      "type": "analytic",
      "label": "Triage WordPress Compromise",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "identify-wordpress-servers",
          "wp-login-activity",
          "rare-php-file-changes"
        ],
        "objective": "Determine if the observed web logins and rare file modifications indicate an unauthorized WordPress account takeover and subsequent PHP backdoor installation.",
        "description": "Correlate authentication events with rare file system changes on the same host.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict linking a specific login event to a specific rare file creation or modification.",
        "success_criteria": "The agent identifies hosts where a successful admin login was followed by a rare PHP file modification in a sensitive WordPress directory."
      },
      "parents": [
        {
          "id": "wp-login-activity",
          "kind": "merge"
        },
        {
          "id": "rare-php-file-changes",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-compromise",
      "type": "checkpoint",
      "label": "Route on Compromise Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious or highly suspicious for at least one host",
        "condition": "the triage verdict is malicious or highly suspicious for at least one host",
        "blind_spot": "incomplete-file-telemetry",
        "confidence": "high",
        "description": "Decide whether to initiate containment based on the agent's findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-wordpress-compromise"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate WordPress Host",
      "config": {
        "target": "endpoint",
        "description": "Isolate the compromised host to prevent further malware distribution.",
        "instructions": "Isolate the identified host and reset WordPress administrative credentials. Capture the suspicious PHP files for forensic analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-compromise",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-file-review",
      "type": "task",
      "label": "Manual File and Backdoor Review",
      "config": {
        "assignee": "analyst",
        "description": "A human analyst reviews the rare files to confirm they are ErrTraffic backdoors.",
        "instructions": "Inspect the content of the suspicious PHP files identified in 'rare-php-file-changes'. Look for XOR-obfuscated JavaScript, shell execution commands, or code that matches the ErrTraffic v3 patterns."
      },
      "parents": [
        {
          "id": "route-compromise",
          "branch": "default"
        },
        {
          "id": "route-compromise",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close Out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and determine if the rare file patterns should be promoted to standing detection rules.",
        "instructions": "Document the compromised hosts, the discovered PHP backdoors, and the associated WordPress accounts. Recommend updates to file monitoring policies for web servers."
      },
      "parents": [
        {
          "id": "route-compromise",
          "branch": "on_refutes"
        },
        {
          "id": "manual-file-review"
        }
      ]
    }
  ]
}