Unmasking “Balada Injector”: A Prolific and Persistent WordPress Malware Campaign

What is Balada Injector?

“Balada Injector” is a long-running and extensive malware campaign that primarily targets WordPress websites. This campaign has been active since 2017 and has infected over a million WordPress sites. It is characterized by its use of various techniques to exploit known and newly discovered vulnerabilities in WordPress themes and plugins. The malware is known for employing obfuscation techniques, using freshly registered domain names for hosting malicious scripts, and redirecting users to scam sites.

In this blogpost, we delve into the intricacies of this notorious malware, its attack techniques, and its remarkable journey from an unclassified campaign to a named entity.

A Prolific, Ongoing Menace

“Balada Injector” is not your run-of-the-mill malware campaign. Since its inception in 2017, it has quietly infiltrated over one million WordPress websites, consistently ranking among the top three infections detected and eradicated by security experts. It became the subject of intrigue and curiosity in the cybersecurity community not only for its scale but also for its remarkable persistence and adaptability.

The campaign’s defining characteristics include a penchant for “String.fromCharCode” obfuscation, deploying freshly registered domain names with malicious scripts hosted on random subdomains, and redirecting users to scam websites. Over the years, it has transformed from merely distributing malware to engaging in a wide range of nefarious activities, from fake tech support schemes to push notification scams.

How “Balada Injector” Got Its Name

Until recently, this notorious campaign was commonly referred to using generic terms such as an “ongoing massive WordPress infection campaign.” The campaign’s notoriety was significant, but it had yet to acquire an official moniker. This changed when security researchers at Dr.Web published a revealing report on December 30, 2022, titled “Linux backdoor WordPress Exploit.” This article brought “Balada Injector” into the limelight.

While Dr.Web’s article presented valuable insights, the campaign’s origins traced back to 2019 and 2020, making it far from new. Nonetheless, the article sparked interest and led to an investigation. Detailed analysis revealed that the malware shared the same DNA as the infamous campaign that the Sucuri team had been tracking. Notably, the campaign was identified by a peculiar list of linked files, with paths indicating a reference to a software named “Balada Client.” To disambiguate and reflect the malware’s true nature, the name “Balada Injector” was born.

In various languages, “Balada” translates to “ballad,” and the term “Injector” was added to signify the malware’s action of injecting malicious code into WordPress sites. The name now provides convenience in referring to this long-lasting, highly adaptable malware campaign.

The Anatomy of “Balada Injector”

To understand the scope of “Balada Injector,” one must dissect its various techniques and functionalities:

1. Infection Waves: “Balada Injector” follows distinct patterns of infection waves, with new, freshly registered domain names being the hallmark of each wave. These domains are often a mishmash of English words, and the campaign uses different subdomains for its injections.

2. Domain Names and Reinfections: The campaign has utilized over a hundred domain names over the years. Some domains are even revisited and reinfected to ensure the malware’s persistence on compromised sites.

3. Attack Vectors vs. Injection Types: “Balada Injector” employs a wide range of attack vectors, depending on the vulnerabilities it exploits. These include siteurl hacks, HTML injections, database injections, and arbitrary file injections.

4. Database Credential Theft: The malware is adept at stealing database credentials from wp-config.php, granting attackers extensive access to the compromised site.

5. Archives and Database Dumps: Attackers also seek out backups and database dumps, hoping to gain further access and exfiltrate sensitive data.

6. Miscellaneous Logs and Scripts: “Balada Injector” diligently searches for files that may contain sensitive or useful information, including access logs, error logs, debug files, and various tools that could be exploited.

7. Assorted Data Collection: The campaign maintains evolving lists of files and information sources for its attacks, allowing it to remain flexible and adaptable.

8. Brute Force Attacks: In an attempt to compromise WordPress admin accounts, “Balada Injector” employs a list of passwords, including both common and unconventional variants.

9. Backdoors: The malware is known for planting multiple backdoors within compromised sites, ensuring persistent access and making detection a challenging task.

10. Cross-Site Infections: “Balada Injector” seeks to infect files across multiple websites on the same server, spreading like wildfire across interconnected sites.

11. Client Hosts & C2 Servers: The campaign relies on a network of “Balada Clients” to scan websites, report successful infections, and exfiltrate data to a central command-and-control (C2) server. This server is sometimes associated with phishing activities.

“Balada Injector” is more than just malware; it’s a sophisticated and adaptive entity that has become a longstanding adversary in the cybersecurity landscape.

The Outlook for “Balada Injector”

As the cybersecurity community uncovers the nuances of “Balada Injector,” the fight against this prolific campaign intensifies. Security experts continue to refine detection methods and mitigation strategies, making it increasingly difficult for the malware to persist. However, “Balada Injector” is a reminder that the battle against cyber threats is ongoing and relentless.

In this evolving landscape, the persistence and adaptability of campaigns like “Balada Injector” emphasize the need for vigilance and continuous improvement in cybersecurity practices. As this campaign continues to evolve, the cybersecurity community must remain one step ahead, ready to face new challenges in the ever-changing realm of digital threats.