Center cybersecurity hoster.by recorded an attempt mass hacking of sites on popular content management systems. December 16 December 16 in less than full 12 minutes a unauthorized access to 90 sites on OpenCart occurred, practically at the same time that most 30 WordPress sites were targeted.
The goal of the attackers in both cases is to change code to direct visitors to outside web resources and gather data about them. A A cause of the vulnerability of sites appears trivial – weak passwords.
Every time the login occurred under the accounting data of users. And in each case they were weak logins and passwords like admin:admin> or test:test123.
All inputs were done from the first attempt and in a short interval of time in 12 minutes. This says that the attackers had all logins and passwords from web resources in advance. It can be concluded that the cyberattack was planned in advance and automated. Hence, it could have affected clients of all hosting providers, considering the popularity of the attacked CMS.
It is noteworthy that the attack was produced from the IP address of the sixth version. This is only the second similar incident in 2024 year as observed by the Center Cybersecurity hoster.by, as typically in the time of cyberincidents using IPv4.
“We daily report attempts of different types of attacks on client resources and operationally address their consequences. But in in the case of mass hacking it is important to show signs, by which all willing people can check their sites, which are in the area of risk. For this we are detailed.describe results of research”, – comments general director of hoster.by Sergey Povalishev.
For owners of OpenCart and WordPress we recommend that you read the technical information about the results of the incident investigation and check, if your website doesn’t show the described signs of hacking.
Without depending on the CMS or engine of your website, cybersecurity experts recommend that you replace the password to a strong password, if for any reason you are still using something like “admin123”.
“No recommendation more basic and at the same time important – make sure that the administrative panel of your site is protected by a strongpassword.The secondrecommendation-monitoryourresourcesandusetoolstoprotectweb applications.It isthankstothatanumberofclientshosterGuard,ouranalystsquicklyreceivednoticesofsuspiciousactivityonthesesitesandimmediatelydetectedtheattemptedhack,”commentstheheadofthesecuritycenterhoster.byAntonTrostyanko.