We have a few sites hosting on a Media Temple (MT) shared server. This morning, we noticed that some of our website were down. Upon investigation, we realized that they had been compromised. The directory structure for MT is as follows: domains>DOMAIN-NAME>html(aka website root).

At the DOMAIN-NAME level, we noticed a file named Meuhy.php. MT's support said that it looked like some sort of malicious package manager. I did a Google search for that file, but I didn't find anything that helped identify its source. I did, however, notice that it has been injected on other websites: https://www.google.com/search?q=meuhy.php&oq=m&aqs=chrome.4.69i60l4j69i59j69i60.5768j0j7&sourceid=chrome&ie=UTF-8

At the web root, we found that WordPress code had been injected into the index.php files, however, all of our sites except for one are Drupal sites. We also discovered that a series of .xml files were generated. They contained what looked like to be a series of server calls. We checked the GPU usage, and noticed that it spiked around that that these files were generated. Our Google Analytics also show that traffic spiked abnormally during this time.

My primary question is, does anyone know what type of attack this is, and should we be concerned that our databases could be compromised?

  • 2
    I'm not sure we can provide any guidance from the name of a php file alone – schroeder May 18 at 12:10
  • I would start by checking what plugins or themes your hacked websites have in common, and their version at the time of the attack. Also check the Wordpress version. Then check if there are any security advisories for them, or if their changelogs mention any relevant bugfixes. But I saw you mentioned a shared server, if they are all hosted on the same server, a vulnerability of the server itself might have been the vector. – reed May 21 at 12:05

I found the Meuhy.php file on 10 WordPress sites. I also found these additional files added to GoDaddy hosted sites:

suspended..php wp_rmder.php test.php

The above files all of the Last Modified date of May 5th or May 14, 2018.

index.php had PHP code injected into it, last modified May 19 and a Google HTML file for verification on the Google search console was added May 19th.

I was first alerted because a new owner of the domain name was added on May 19th. I noticed that 5 XML sitemaps had been added that day, each with approximately 40,000 URLs.

  • Looks like we're hit by the same people. I posted about our findings above. Good luck! – Kellen Jun 7 at 12:45
up vote 0 down vote accepted

We've discovered that Meuhy.php allowed attackers to change permissions of any directory as well as upload files. It would seem that the file itself could be used in many different ways. In our case, it would seem that the attackers wanted to use our websites to serve up spam.

We found that the attacker had added him or herself as an owner on our Google Search Console account by added their own Google verification .html document in our web roots. They then requested that two of our sites be indexed. The .xml files that were uploaded are essentially sitemaps containing 40,000 URLs each. In total, each website served up 200,000 URLs across five .xml files. Utilizing Search Consoles Search Analytics, we found that most of the served links were Japanese.

I found this article which explains this type of attack in more detail. I hope the best for anyone else that was effected: https://blog.sucuri.net/2015/09/malicious-google-search-console-verifications.html

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.