DreamHost Breach: Defending Against Stolen FTP/SFTP Credentials and Webmail Session Hijacking

---
title: Suspicious File Upload to Web Directory via FTP/SFTP
id: 8f3a2c91-4b7e-4d5a-9c1f-2e8b6a4d7f3c
status: experimental
description: Detects file uploads with web shell extensions or suspicious filenames to web-accessible directories following DreamHost breach.
references:
  - https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/var/www/'
      - '/home/*/public_html/'
      - '/usr/share/nginx/'
      - '/srv/http/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.phar'
      - '.asp'
      - '.aspx'
      - '.jsp'
      - '.jspx'
  filter_known_uploads:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/sites/default/files/'
  condition: selection and not filter_known_uploads
falsepositives:
  - Legitimate CMS file uploads by administrators
  - Deployment pipelines pushing code changes
level: high
---
title: Unusual FTP/SFTP Authentication from Non-Standard Source
id: 2c7f9a4e-8d3b-4a1f-9e5c-7b2d6f3a8c9e
status: experimental
description: Detects FTP/SFTP authentication events from source IPs with no prior authentication history, indicative of stolen credential use.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1021
logsource:
  category: authentication
  product: linux
  service: ftp
detection:
  selection:
    EventType: 'authentication_success'
    Protocol:
      - 'ftp'
      - 'sftp'
  condition: selection
falsepositives:
  - Legitimate user access from new locations (travel, ISP changes)
  - Automated backup services with rotating IPs
level: medium
---
title: Modification of CMS Configuration Files via FTP
id: 5d8b3f2a-9c4e-4b7a-8f1d-3e6c9a2b5d7f
status: experimental
description: Detects modification of critical CMS configuration files (wp-config.php, .env) that contain database credentials and application secrets.
references:
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
      - 'wp-config.php'
      - '.env'
      - 'config.php'
      - 'database.yml'
      - 'settings.php'
      - 'configuration.php'
    EventType:
      - 'write'
      - 'modify'
      - 'rename'
falsepositives:
  - Legitimate configuration updates by developers
  - CMS auto-update mechanisms
level: high

// Hunt for FTP/SFTP authentication from new source IPs following DreamHost breach window
// Adjust time range based on when credentials may have been compromised
let BreachWindowStart = datetime(2026-02-01); // Adjust based on DreamHost disclosure timeline
let BreachWindowEnd = datetime(2026-04-06);
let KnownIPs = Syslog
    | where TimeGenerated < BreachWindowStart
    | where ProcessName contains "ftpd" or ProcessName contains "sshd" or Facility == "ftp"
    | where SyslogMessage contains "Accepted password" or SyslogMessage contains "session opened"
    | extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
    | where isnotempty(SourceIP)
    | summarize by SourceIP;
Syslog
| where TimeGenerated between (BreachWindowStart .. BreachWindowEnd)
| where ProcessName contains "ftpd" or ProcessName contains "sshd" or Facility == "ftp"
| where SyslogMessage contains "Accepted password" or SyslogMessage contains "session opened"
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| extend Username = extract(@"for (\S+) from", 1, SyslogMessage)
| where SourceIP !in (KnownIPs)
| project TimeGenerated, Computer, SourceIP, Username, SyslogMessage
| order by TimeGenerated desc;

// Hunt for suspicious file uploads to web directories
Syslog
| where TimeGenerated between (BreachWindowStart .. BreachWindowEnd)
| where SyslogMessage contains "STOR" or SyslogMessage contains "uploaded" or SyslogMessage contains "PUT"
| where SyslogMessage has_any (".php", ".phtml", ".phar", ".asp", ".jsp")
| where SyslogMessage !has_any ("wp-content/uploads", "sites/default/files")
| extend Filename = extract(@"(\S+\.(php|phtml|phar|asp|jsp))", 1, SyslogMessage)
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| project TimeGenerated, Computer, SourceIP, Filename, SyslogMessage
| order by TimeGenerated desc;

// Hunt for webmail session anomalies (if DreamHost logs are forwarded)
CommonSecurityLog
| where TimeGenerated between (BreachWindowStart .. BreachWindowEnd)
| where DeviceProduct contains "webmail" or ApplicationProtocol == "HTTPS"
| where RequestURL contains "webmail" or RequestURL contains "roundcube" or RequestURL contains "squirrelmail"
| extend SessionID = extract(@"session[=:]([^&;]+)", 1, AdditionalExtensions)
| summarize SessionCount = dcount(SessionID), SourceIPs = make_set(SourceIP) by DestinationHostName, bin(TimeGenerated, 1h)
| where array_length(SourceIPs) > 3 // Same account, multiple source IPs in short window
| order by TimeGenerated desc

-- Hunt for suspicious PHP files and recently modified CMS configs in web directories
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    Mode,
    hash(path=FullPath) AS FileHash
FROM glob(
    globs=[
        '/var/www/**/*.php',
        '/home/*/public_html/**/*.php',
        '/usr/share/nginx/html/**/*.php',
        '/home/*/public_html/**/.env',
        '/home/*/public_html/**/wp-config.php',
        '/var/www/**/wp-config.php'
    ],
    accessor='file'
)
WHERE 
    -- Recently modified (adjust timeframe based on breach window)
    Mtime > '2026-02-01'
    AND (
        -- Common web shell filenames
        FullPath =~ '(cmd|shell|backdoor|upload|test|info|phpinfo)\\.php$'
        OR 
        -- Files in unusual locations
        FullPath =~ '/(tmp|cache|images|uploads)/[^/]+\\.php$'
        OR
        -- Configuration files modified recently
        (FullPath =~ '(wp-config|\\.env|config)\\.php$' AND Mtime > '2026-02-01')
    )
ORDER BY Mtime DESC

#!/bin/bash
# DreamHost Breach Response Script
# Run on any Linux server that used DreamHost FTP/SFTP or File Manager

echo "[+] DreamHost Breach Response - $(date)"
echo "[+] This script checks for indicators of compromise and enforces credential rotation"

# Configuration
LOG_FILE="/var/log/dreamhost_breach_response_$(date +%Y%m%d_%H%M%S).log"
BREACH_START="2026-02-01" # Adjust based on DreamHost notification

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# 1. Check for recently modified PHP files in web directories
log "Checking for recently modified PHP files since $BREACH_START..."
find /var/www /home/*/public_html /usr/share/nginx/html -type f -name "*.php" -newermt "$BREACH_START" 2>/dev/null | while read file; do
    log "  [ALERT] Recently modified PHP: $file"
    # Check for common web shell patterns
    if grep -qE "(eval\(|base64_decode|gzinflate|str_rot13|shell_exec|system\(|passthru|exec\()" "$file"; then
        log "  [CRITICAL] Suspicious code pattern in $file"
        md5sum "$file" | tee -a "$LOG_FILE"
    fi
done

# 2. Check for recently modified configuration files
log "Checking for modified configuration files..."
find /var/www /home/*/public_html -type f \( -name "wp-config.php" -o -name ".env" -o -name "config.php" \) -newermt "$BREACH_START" 2>/dev/null | while read file; do
    log "  [WARNING] Recently modified config: $file"
    ls -lah "$file" | tee -a "$LOG_FILE"
done

# 3. Check FTP/SFTP logs for authentication from new IPs
log "Checking FTP/SFTP authentication logs..."
if [ -f /var/log/vsftpd.log ]; then
    grep -E "OK LOGIN|FAIL LOGIN" /var/log/vsftpd.log | grep -E "$(date -d "$BREACH_START" +%b\ %e)|$(date +%b\ %e)" | tee -a "$LOG_FILE"
elif [ -f /var/log/proftpd/proftpd.log ]; then
    grep -E "USER|PASS" /var/log/proftpd/proftpd.log | tail -100 | tee -a "$LOG_FILE"
fi

# Check SSH logs for SFTP authentication
log "Checking SSH/SFTP authentication logs..."
grep -E "Accepted password|Accepted publickey" /var/log/auth.log /var/log/secure 2>/dev/null | grep -E "$(date -d "$BREACH_START" +%b\ %d)" | tee -a "$LOG_FILE"

# 4. List all FTP users
log "Enumerating FTP users..."
if [ -f /etc/vsftpd/user_list ]; then
    cat /etc/vsftpd/user_list | tee -a "$LOG_FILE"
fi
if [ -f /etc/proftpd/proftpd.conf ]; then
    grep -E "^<Limit|AllowUser" /etc/proftpd/proftpd.conf | tee -a "$LOG_FILE"
fi

# 5. Force password rotation for local FTP users (manual step required)
log "[ACTION REQUIRED] Rotate all FTP/SFTP passwords immediately"
log "  For system users: sudo passwd <username>"
log "  For virtual users: Update passwords in FTP server config or database"

# 6. Revoke active FTP/SFTP sessions
log "Terminating active FTP/SFTP sessions..."
if systemctl is-active --quiet vsftpd; then
    systemctl restart vsftpd
    log "  [+] Restarted vsftpd to terminate active sessions"
elif systemctl is-active --quiet proftpd; then
    systemctl restart proftpd
    log "  [+] Restarted proftpd to terminate active sessions"
fi

# For SSH/SFTP: kill active sessions (use with caution)
log "Listing active SSH/SFTP sessions (manual termination required)..."
who -u | grep -E "sshd|sftp" | tee -a "$LOG_FILE"
log "  To terminate: sudo pkill -u <username> sshd"

# 7. Implement IP whitelisting for FTP (if feasible)
log "[RECOMMENDATION] Implement IP whitelisting for FTP/SFTP access"
log "  vsftpd: Add 'tcp_wrappers=YES' and configure /etc/hosts.allow"
log "  proftpd: Use <Limit LOGIN> with Allow from <IP>"
log "  SSH/SFTP: Configure AllowUsers in /etc/ssh/sshd_config"

# 8. Enable detailed FTP logging
log "[RECOMMENDATION] Enable verbose FTP logging"
if [ -f /etc/vsftpd.conf ]; then
    log "  Add to /etc/vsftpd.conf:"
    log "    log_ftp_protocol=YES"
    log "    xferlog_enable=YES"
    log "    xferlog_std_format=NO"
fi

# 9. Check for unauthorized cron jobs
log "Checking for suspicious cron jobs..."
for user in $(cut -f1 -d: /etc/passwd); do
    crontab -u "$user" -l 2>/dev/null | grep -E "curl|wget|php|bash|sh" | while read cron; do
        log "  [CHECK] User $user has suspicious cron: $cron"
    done
done

# 10. Audit file permissions on web directories
log "Auditing file permissions (files should not be world-writable)..."
find /var/www /home/*/public_html -type f -perm -002 2>/dev/null | head -20 | while read file; do
    log "  [WARNING] World-writable file: $file"
done

log "[+] Response script complete. Review $LOG_FILE for findings."
log "[+] IMMEDIATE ACTIONS:"
log "    1. Rotate ALL FTP/SFTP passwords for DreamHost accounts"
log "    2. Force logout all webmail sessions (change passwords via DreamHost panel)"
log "    3. Review and remove any suspicious files identified above"
log "    4. Update all CMS (WordPress, Drupal, Joomla) to latest versions"
log "    5. Enable two-factor authentication on DreamHost control panel"
log "    6. Monitor for unauthorized DNS changes in DreamHost panel"

4. **Enable File Integrity Monitoring (FIM):**
   - Use OSSEC, Tripwire, or commercial FIM solutions
   - Alert on changes to critical files: wp-config.php, .htaccess, .env
   - Monitor for new files in web directories

5. **Implement Least Privilege for FTP Users:**
   - Create separate FTP users for different functions (uploads only, no delete)
   - Restrict FTP users to specific directories (chroot)
   - Avoid using control panel admin credentials for FTP

6. **Security Awareness Training:**
   - Educate users on the risks of using File Manager for sensitive operations
   - Prefer SFTP clients (FileZilla, WinSCP) over web-based file managers
   - Never store credentials in browser password managers for hosting control panels

### Vendor-Specific Guidance

**DreamHost Official Resources:**
- DreamHost Status Page: https://www.dreamhoststatus.com/
- DreamHost Security: https://help.dreamhost.com/hc/en-us/categories/201240306-Security
- DreamHost Support: https://panel.dreamhost.com/support/

**CISA Guidance:**
- No CISA KEV entry (no CVE assigned)
- Follow CISA guidance on credential hygiene: https://www.cisa.gov/news-events/cybersecurity-advisories

---

## Conclusion

The DreamHost breach highlights a critical reality: **centralized file management platforms are high-value targets** because they aggregate credentials and provide direct access to customer infrastructure. The two-month persistence window means attackers had time to establish deep footholds. Defenders must assume compromise, rotate credentials immediately, and conduct thorough forensic analysis.

For SOC teams, this incident underscores the importance of:
- **Behavioral anomaly detection** (new IPs, unusual authentication patterns)
- **File integrity monitoring** on web-accessible directories
- **Rapid credential rotation** procedures tested in advance
- **Minimizing reliance on web-based file managers** for sensitive operations

If your organization uses DreamHost or any shared hosting provider, treat this as a forcing function to migrate to SSH key authentication, implement IP whitelisting, and eliminate plaintext credential storage.

---

## Related Resources

[Security Arsenal Incident Response Services](https://securityarsenal.com/services/incident-response)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[incident-response Intel Hub](https://securityarsenal.com/intel/incident-response)