Recently, a client asked for assistance in migrating their WordPress site hosted on FastComet, which had been compromised by malware and subsequently blocked by the hosting provider. The objective was to remove the malicious software and move the site to Cloudways.
Initially, the task seemed straightforwardโjust remove the malware and transfer WordPress. However, it turned out to be related to malware associated with the Kimsuky group, prompting me to share these details. I appreciate your understanding if the information gets a bit tedious ๐.
For your reference, FastComet is a highly affordable shared hosting service similar in level to Bluehost. However, Bluehost only provides servers in the U.S., leading to slower speeds in South Korea and resulting in customer complaints. FastComet offers a Tokyo server, which affords relatively decent speeds within South Korea. Similarly, ChemiCloud has implemented a server in Seoul, contributing to faster performance for users in Korea.
Malware Created by the Kimsuky Group
FastComet detected the malware and restricted access to the site. By contacting live chat, users could request access through their IP address to facilitate malware removal.
When regular users attempted to access the site, a 403 Forbidden error was displayed as shown in the image below.
Upon receiving cPanel credentials and accessing the server, I discovered several folders unrelated to WordPress.
In the image above, it seems that folders not starting with "wp-" are invalid directories.
- attachfile
- mokozy
- ncorp
- public
- room
- totmem
Particularly noteworthy among the listed items is the "mokozy" folder, which contained several files as seen below.
The files appeared to have been created in September 2023, indicating that the site was likely infected by malware around this time.
Initially, I was unsure if these files were necessary, so I attempted to back them up by downloading. However, the AhnLab antivirus software flagged them as malware and blocked the download.
Eventually, I learned that these files were suspected malware crafted by the notorious Kimsuky group from North Korea.
In relation to this, the AhnLab analysis team discovered malware disguised as cryptocurrency exchange and investment content, elaborating on its functioning. To summarize:
This malware spreads in the form of executable files and Word documents. Opening a document can trigger the execution of scripts from a malicious URL or activate a VBA macro, prompting the user to enable content. As a result, malware may be downloaded, or data may be stolen. Notably, the email may contain a self-extracting archive file that appears legitimate, making it easy for users to be deceived. This type of malware demands extra caution.
Running MS Word documents or executable files infected with malware would invoke and execute the PHP files located under the mokozy folder on the server.
FastComet has its own malware scanning system, regularly scanning for malicious software, but it appears that this particular malware went undetected for over a year.
It is worth noting that a computer infected with malware could upload it to a server. Consequently, SiteGround blocks sites upon discovering malware and requests users to prove their computers are malware-free before lifting the block.
Malware Removal and Site Migration
If your site gets blocked due to malware infection, contact your hosting provider to inform them of your IP address, and they will typically unblock it to allow access. You can find your IP address by searching "My IP" on Naver.
Once the hosting provider unblocks your IP address, you will have access to WordPress. However, tasks such as installing, deactivating, or deleting plugins may be restricted due to permission issues.
I used FTP to access the site, scan and delete suspicious files, and then downloaded necessary files. Additionally, I accessed phpMyAdmin to back up the database. FastComet provides cPanel, allowing access to phpMyAdmin after logging in to cPanel.
After ensuring all malware had been removed, I was able to migrate the data and database to a new hosting service. For Cloudways, I created a new application, restored the site, and linked the domain.
To minimize potential errors after restoring the site, it's advisable to keep the PHP versions of the previous and new servers as similar as possible.
FastComet was running PHP version 7.4.
Likewise, the server created on Cloudways also had PHP version 7.4.
Both FastComet and Cloudways allow for easy changes to the PHP version. If errors arise after changing, it's possible to revert to a previous PHP version. In contrast, at Cafe24, a popular Korean webhosing service, switching from PHP 7.4 to 8.2 necessitates server migration, necessitating backups & restoration, which can be quite cumbersome.
Itโs essential to check and remove malware from both the data and database, and whenever possible, update the site to the latest version to reduce the risk of recurrence.
Server Downtime After Migration
Following the migration and the verification that no malware remained, the site operated smoothly for a few days before unexpectedly going down. The server provider temporarily blocked it for suspected activity that violated their terms of service. Upon investigation, it was apparent that excessive access to specific PHP files under the mokozy folder had triggered this suspicion.
All unusual folders, including the mokozy folder, had been deleted. It seems that attempts to execute files within the mokozy folder from an infected computer were flagged as suspicious by the hosting provider.
To prevent access to paths starting with the mokozy directory, I added the following code.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^mokozy/ - [F,L]
</IfModule>Adding this code will prompt a 403 Forbidden error page when attempting to access URLs starting with that directory.
After confirming the removal of all suspicious files and checking the database for any malicious scripts, the server block was lifted after about half a day.
Conclusion
While WordPress is generally secure, neglecting to update WordPress, themes, or plugins, or disregarding security practices can lead to vulnerabilities, resulting in hacking incidents or malware infections. Users should exercise caution to prevent their PCs from being infected with malware. Opening suspicious documents received via email could lead to malware infections, which in turn may result in hacking or malware issues on WordPress sites.
