wp2shell RCE Chain & CMSmap Webshell Deployment: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Recent OTX pulse data indicates the active exploitation of a critical vulnerability chain dubbed "wp2shell" affecting WordPress Core. This campaign leverages a combination of CVE-2026-63030 and CVE-2026-60137 to achieve pre-authentication Remote Code Execution (RCE) on default installations. The attack chain is highly automated, allowing unauthenticated actors to gain immediate control over target servers.

Observations suggest that threat actors are utilizing the CMSmap tool—typically a CMS scanner—to facilitate the exploitation or map the post-exploitation environment. The primary objective appears to be the deployment of webshells for persistent access, likely leading to server hijacking, credential theft, or the use of compromised infrastructure as proxy nodes for further malicious campaigns. The presence of Akamai and Bezeq IP addresses in the IOCs suggests the use of routed or cloud infrastructure to obfuscate the true origin of the command and control (C2) servers.

Threat Actor / Malware Profile

Malware/Tooling: CMSmap, Webshells (custom PHP scripts).
Distribution Method: Direct exploitation via HTTP/HTTPS against WordPress endpoints. The attackers exploit the "batch API" and plugin upload vulnerabilities inherent in the wp2shell chain.
Payload Behavior: Upon successful exploitation, the attacker uploads a webshell (evidenced by the provided SHA1 file hashes). This shell provides full command execution capabilities on the underlying operating system.
C2 Communication: The webshells appear to callback to specific IP addresses (e.g., 79.177.131.206, 172.235.128.52) to receive instructions. Traffic may be encapsulated within standard HTTP POST requests to blend in with legitimate web traffic.
Persistence Mechanism: Persistence is achieved by hiding malicious PHP scripts within the WordPress wp-content/uploads or wp-content/plugins directories, often masquerading as legitimate plugin files.
Anti-Analysis Techniques: The use of CMSmap allows actors to perform reconnaissance before exploitation, ensuring the target is vulnerable before deploying the webshell, minimizing noise in some environments.

IOC Analysis

The provided indicators of compromise (IOCs) consist of 5 SHA1 file hashes and 2 IPv4 addresses.

File Hashes (SHA1): These hashes correspond to the webshells or exploit payloads dropped on the target file system. SOC teams should utilize YARA rules or EDR hash-comparison capabilities to scan the web root directories of all public-facing WordPress servers.
IPv4 Addresses: 172.235.128.52 (Akamai) and 79.177.131.206 (Bezeq). The Akamai IP suggests potential use of Fastly or Akamai edge services for C2 redirection, a technique used to bypass geoblocking and reputation filtering. The Bezeq IP originates from Israel. These should be blocked at the perimeter firewall and loaded into threat intelligence platforms for alerting on outbound egress traffic.

Detection Engineering

Sigma Rules

YAML

title: WordPress wp2shell Exploitation Attempt via CMSmap
id: 55a4aa0a-8f32-45a0-992e-5b67a726c9d9
description: Detects potential exploitation of CVE-2026-63030/CVE-2026-60137 (wp2shell) characterized by suspicious process spawning by web server software or CMSmap scanning patterns.
status: experimental
date: 2026/07/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6789123 # Placeholder reference to the specific pulse
logsource:
    category: process_creation
    product: linux
detection:
    selection_webserver:
        ParentImage|endswith:
            - '/apache2'
            - '/httpd'
            - '/nginx'
            - '/php-fpm'
    selection_shell:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/nc'
            - '/curl'
            - '/perl'
    selection_keywords:
        CommandLine|contains:
            - 'cmsmap'
            - 'wp2shell'
            - 'CVE-2026-63030'
    condition: 1 of selection*
falsepositives:
    - Legitimate administrative web management
level: critical

---

title: WordPress Webshell C2 Connection to wp2shell Infrastructure
id: 88b2131d-99c5-4e45-ba1c-1d2e3f4a5b6c
description: Detects outbound network connections from web server processes to known wp2shell C2 infrastructure identified in OTX pulses.
status: experimental
date: 2026/07/25
author: Security Arsenal
logsource:
    category: network_connection
    product: linux
detection:
    selection_webproc:
        Image|endswith:
            - '/apache2'
            - '/httpd'
            - '/nginx'
    selection_c2_ips:
        DestinationIp:
            - '172.235.128.52'
            - '79.177.131.206'
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical

---

title: Suspicious File Creation in WordPress Directories
id: 22a44b9c-1d2e-3f4a-5b6c-7d8e9f0a1b2c
description: Detects creation of PHP files in WordPress upload or plugin directories, a common TTP for webshell persistence following wp2shell exploitation.
status: experimental
date: 2026/07/25
author: Security Arsenal
logsource:
    category: file_create
    product: linux
detection:
    selection_paths:
        TargetFilename|contains:
            - '/wp-content/uploads/'
            - '/wp-content/plugins/'
    selection_extension:
        TargetFilename|endswith: '.php'
    condition: all of selection_
falsepositives:
    - Legitimate plugin updates or file uploads by authenticated admins (filter by user if possible)
level: high

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for connections to wp2shell C2 IPs
DeviceNetworkEvents
| where RemoteIP in ("172.235.128.52", "79.177.131.206")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessFileName
| order by TimeGenerated desc

// Hunt for suspicious web server process activity
DeviceProcessEvents
| where InitiatingProcessFileName in ("apache2", "httpd", "nginx", "php-fpm")
| where ProcessFileName in ("bash", "sh", "perl", "python", "nc", "curl")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine
| order by TimeGenerated desc

PowerShell Hunt Script

PowerShell

<#
.SYNOPSIS
    Hunt script to scan for wp2shell related webshell file hashes on the file system.
#>

$TargetDirectory = "C:\inetpub\wwwroot" # Adjust for Linux paths if running via PowerShell Core (e.g. /var/www/html)
$HashList = @(
    "2a1410d8e2a8337ac2171cedea8c0fdc47c647a0",
    "58eca847e9eae9e6b08cc211f1559817b71bc4cc",
    "d9a220c8039f1c4d72cae7ccb8b3a33dec8815be",
    "e9756e2338f84746007235e4cab7a70d5b3ca47f",
    "ebea44890f434d5d67ede22009a3f4bb5cac33f8"
)

Write-Host "[+] Scanning $TargetDirectory for wp2shell indicators..."

$Files = Get-ChildItem -Path $TargetDirectory -Recurse -File -ErrorAction SilentlyContinue

foreach ($File in $Files) {
    if ($File.Length -gt 0 -and $File.Length -lt 5MB) { # Optimize: skip very large files
        $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue).Hash
        if ($Hash -in $HashList) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($File.FullName) - Hash: $Hash" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Scan complete."

Response Priorities

Immediate:
- Block the listed IP addresses (172.235.128.52, 79.177.131.206) at the perimeter firewall.
- Apply the provided Sigma rules to detection stacks to identify active exploitation or webshell callbacks.
- Scan all WordPress web roots for the listed SHA1 hashes.
24 Hours:
- Review web server logs (access/error logs) for unusual POST requests to wp- or plugin upload endpoints around the exploitation dates.
- If webshells are found, assume full server compromise and initiate incident response procedures for credential rotation (database, FTP, SSH).
1 Week:
- Patch WordPress Core to the latest version to mitigate CVE-2026-63030 and CVE-2026-60137.
- Implement a Web Application Firewall (WAF) rule to block the specific attack patterns associated with the wp2shell chain.
- Conduct a review of plugin and theme integrity across the enterprise CMS estate.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

wp2shell RCE Chain & CMSmap Webshell Deployment: OTX Pulse Analysis — Enterprise Detection Pack