1

We have a few sites hosting on a Media Temple (MT) shared server. This morning, we noticed that some of our website were down. Upon investigation, we realized that they had been compromised. The directory structure for MT is as follows: domains>DOMAIN-NAME>html(aka website root).

At the DOMAIN-NAME level, we noticed a file named Meuhy.php. MT's support said that it looked like some sort of malicious package manager. I did a Google search for that file, but I didn't find anything that helped identify its source. I did, however, notice that it has been injected on other websites: https://www.google.com/search?q=meuhy.php&oq=m&aqs=chrome.4.69i60l4j69i59j69i60.5768j0j7&sourceid=chrome&ie=UTF-8

At the web root, we found that WordPress code had been injected into the index.php files, however, all of our sites except for one are Drupal sites. We also discovered that a series of .xml files were generated. They contained what looked like to be a series of server calls. We checked the GPU usage, and noticed that it spiked around that that these files were generated. Our Google Analytics also show that traffic spiked abnormally during this time.

My primary question is, does anyone know what type of attack this is, and should we be concerned that our databases could be compromised?

Improve this question
2
  • 2
    I'm not sure we can provide any guidance from the name of a php file alone
    – schroeder ♦
    May 18, 2018 at 12:10
  • I would start by checking what plugins or themes your hacked websites have in common, and their version at the time of the attack. Also check the Wordpress version. Then check if there are any security advisories for them, or if their changelogs mention any relevant bugfixes. But I saw you mentioned a shared server, if they are all hosted on the same server, a vulnerability of the server itself might have been the vector.
    – reed
    May 21, 2018 at 12:05

2 Answers 2

Reset to default
1

I found the Meuhy.php file on 10 WordPress sites. I also found these additional files added to GoDaddy hosted sites:

suspended..php wp_rmder.php test.php

The above files all of the Last Modified date of May 5th or May 14, 2018.

index.php had PHP code injected into it, last modified May 19 and a Google HTML file for verification on the Google search console was added May 19th.

I was first alerted because a new owner of the domain name was added on May 19th. I noticed that 5 XML sitemaps had been added that day, each with approximately 40,000 URLs.

Improve this answer
1
  • Looks like we're hit by the same people. I posted about our findings above. Good luck!
    – Kellen
    Jun 7, 2018 at 12:45
0

We've discovered that Meuhy.php allowed attackers to change permissions of any directory as well as upload files. It would seem that the file itself could be used in many different ways. In our case, it would seem that the attackers wanted to use our websites to serve up spam.

We found that the attacker had added him or herself as an owner on our Google Search Console account by added their own Google verification .html document in our web roots. They then requested that two of our sites be indexed. The .xml files that were uploaded are essentially sitemaps containing 40,000 URLs each. In total, each website served up 200,000 URLs across five .xml files. Utilizing Search Consoles Search Analytics, we found that most of the served links were Japanese.

I found this article which explains this type of attack in more detail. I hope the best for anyone else that was effected: https://blog.sucuri.net/2015/09/malicious-google-search-console-verifications.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .