Posted on

2026-10-27 UpdraftCentral Stolen Keys and WordPress Backdoors — Microsoft Sentinel Threat Hunts

Threat Overview

An October 17–18 compromise of TeamUpdraft's website exposed cloud-hosted UpdraftCentral remote-management connection keys. Researchers observed an attacker use valid signed remote-management commands to install malicious WordPress plugins during October 18–19. This is credential/key abuse, not a new unauthenticated vulnerability in the UpdraftPlus plugin. The attacker used plugin.upload_plugin to deploy backdoors that could create an apparently Editor-level account with powerful additional capabilities (manage_options, install_plugins) and establish persistent access. Some plugin samples caused HTTP 500 errors, but that failure is not required for other variants. The vendor released UpdraftPlus 1.26.13 / Premium 2.26.13 on October 19 to revoke older connections; researchers have reported that certain keys created around the cutoff could remain, so explicit deletion of old keys remains important. This threat is included because it is confirmed real-world exploitation of a high-trust WordPress management channel and the risk persists wherever compromised keys remain active; the primary research was published October 19 and Check Point Research summarized the incident October 26.

References

Impacted Systems

  • Vendor/products: TeamUpdraft UpdraftPlus free and Premium WordPress plugin with an active connection key to cloud-hosted UpdraftCentral; self-managed WordPress sites, including staging environments. The UpdraftCentral client is bundled in the plugin, but an active cloud connection key is required.
  • Affected versions: key compromise is not tied to a plugin coding flaw; even versions current on October 18 could accept attacker-signed commands if a stolen key existed. Version 1.26.13 (free) / 2.26.13 (Premium), released October 19, revokes older cloud keys, but does not remove installed backdoors. Manual key deletion covers cutoff exceptions.
  • Unaffected: self-hosted UpdraftCentral, per TeamUpdraft; ordinary UpdraftPlus backup archives and downloads were not modified. Free sites with no TeamUpdraft account and no cloud connection key are outside this key-compromise path.
  • Exposure: the WordPress site must be reachable by an attacker who possesses its cloud dashboard key; no publicly exposed administration port or unauthenticated code vulnerability is required. HTTP POSTs to the site root can carry legitimate-looking signed remote commands.
  • Related but separate: CVE-2026-10795 was an earlier unsigned-command defect fixed in UpdraftPlus 1.26.5 / 2.26.5; do not conflate it with stolen-key exploitation.

Why this matters

Remote management channels can bypass routine administrator-login detection and allow malicious plugin installation without a visible interactive WordPress login. Network, web and endpoint evidence can reveal signed remote-command abuse, malicious plugin files, privileged fake Editor accounts and persistence.

Exploitation Status

Confirmed exploitation: Patchstack observed backdoor installations between 2026-10-18 15:32 and 2026-10-19 09:23 (time basis per researcher). TeamUpdraft confirmed unauthorized website access and issued key-revocation updates. No claim is made that the same attacker remained active after the last confirmed events. Reported IPv4 43.250.53.42 and IPv6 2a09:bac5:4e21:2e3c::49b:9 are incident indicators, not exhaustive infrastructure.

What this hunt looks for

Hunts target reported attacker addresses, explicit UpdraftCentral command strings in forwarded application logs, new PHP plugins, backdoor file descriptions, suspicious account/role logs if forwarded, unusual webserver child processes, 5xx spikes and Windows process-creation fallback. The exact signed POST body is not claimed visible from ordinary network flow logs.

Required logs

Each query requires its named Microsoft Sentinel table. No customer log ingestion or product deployment is assumed.

  • Hunt 01: CommonSecurityLog
  • Hunt 02: Syslog
  • Hunt 03: Syslog
  • Hunt 04: DeviceFileEvents
  • Hunt 05: DeviceProcessEvents
  • Hunt 06: AzureDiagnostics
  • Hunt 07: SecurityEvent
  • Hunt 08: AzureDiagnostics

Hunt 01 — Reported attacker IP contact in normalized perimeter telemetry

CommonSecurityLog
| where TimeGenerated > ago(21d)
| where SourceIP in ("43.250.53.42","2a09:bac5:4e21:2e3c::49b:9") or DestinationIP in ("43.250.53.42","2a09:bac5:4e21:2e3c::49b:9")
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction, RequestURL, DestinationHostName
| order by TimeGenerated desc

Hunt 02 — UpdraftCentral signed remote plugin-install command in forwarded logs

Syslog
| where TimeGenerated > ago(21d)
| where SyslogMessage has "plugin.upload_plugin" or (SyslogMessage has "updraftcentral" and SyslogMessage has_any ("Command received","probe.central.updraftplus.com"))
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

Hunt 03 — Reported backdoor plugin description in forwarded application logs

Syslog
| where TimeGenerated > ago(21d)
| where SyslogMessage has "Small maintenance toolkit: keeps option storage tidy" or SyslogMessage has "Site Health Cache" or SyslogMessage has "data-ops43" or SyslogMessage has "media-staff96"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

Hunt 04 — New PHP files under WordPress plugins or must-use plugins

DeviceFileEvents
| where TimeGenerated > ago(21d)
| where ActionType in~ ("FileCreated","FileModified","FileRenamed")
| where FolderPath has "wp-content" and (FolderPath has "plugins" or FolderPath has "mu-plugins")
| where FileName endswith ".php"
| project TimeGenerated, DeviceName, ActionType, InitiatingProcessFileName, FileName, FolderPath, SHA256
| order by TimeGenerated desc

Hunt 05 — Webserver child process consistent with malicious plugin execution

DeviceProcessEvents
| where TimeGenerated > ago(21d)
| where InitiatingProcessFileName in~ ("php-fpm","php-fpm8.2","php-fpm8.3","php-fpm8.4","php.exe","httpd","httpd.exe","apache2","nginx")
| where FileName in~ ("sh","bash","dash","curl","wget","cmd.exe","powershell.exe","python3","nc","ncat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

Hunt 06 — Application Gateway HTTP 500 bursts after suspected plugin installs

AzureDiagnostics
| where TimeGenerated > ago(21d) and Category == "ApplicationGatewayAccessLog"
| extend Status=toint(column_ifexists("httpStatus_d", real(null))), Uri=tostring(column_ifexists("requestUri_s", "")), Client=tostring(column_ifexists("clientIP_s", ""))
| where Status between (500 .. 599)
| summarize Errors=count(), Sources=dcount(Client), Paths=make_set(Uri, 5) by ResourceId, bin(TimeGenerated, 15m)
| where Errors >= 10
| order by Errors desc

Hunt 07 — Windows 4688 fallback: PHP web worker launches shell

SecurityEvent
| where TimeGenerated > ago(21d) and EventID == 4688
| where ParentProcessName has_any ("php.exe","httpd.exe","nginx.exe")
| where NewProcessName has_any ("cmd.exe","powershell.exe","certutil.exe","bitsadmin.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

Hunt 08 — Reported attacker IP in Azure WAF access or firewall events

AzureDiagnostics
| where TimeGenerated > ago(21d)
| where Category in ("ApplicationGatewayFirewallLog","FrontDoorWebApplicationFirewallLog")
| extend Client=tostring(column_ifexists("clientIP_s", "")), Uri=tostring(column_ifexists("requestUri_s", "")), Action=tostring(column_ifexists("action_s", ""))
| where Client in ("43.250.53.42","2a09:bac5:4e21:2e3c::49b:9")
| project TimeGenerated, ResourceId, Category, Client, Uri, Action
| order by TimeGenerated desc

Detection Notes

Highest signal: an ingested plugin.upload_plugin event in UpdraftCentral logs, the exact backdoor plugin description, or a reported attacker IP contacting a WordPress asset. Noise: legitimate remote plugin installs, normal WordPress updates, routine PHP files and 5xx errors. WAF access logs usually lack POST bodies and WordPress database role/capability changes; without WordPress/UpdraftCentral audit forwarding, a malicious Editor account cannot be proven from Sentinel alone. The plugin may create a user with Editor display role but admin-like capabilities; role-name checks alone miss it. Indicators from October 19 may be rotated. Device* queries only work where host EDR is ingested, Syslog only where application messages are forwarded. The 1.26.13 update invalidates old connections but cannot undo already-installed malware.

Leave a Reply