GoDaddy Security researchers have identified a persistent malware operation known as "DollyWay," which has been active since 2016 and has compromised over 20,000 websites worldwide. This sophisticated campaign’s infrastructure primarily exploits a network of infected WordPress sites, which function as Traffic Direction System (TDS) and Command and Control (C2) nodes. The current version, DollyWay v3, is notable for its advanced features, including cryptographically signed data transfers, various injection methods, and automatic reinfection processes.
The campaign initially appeared to involve multiple independent malware operations but has been traced back to a single, complex threat actor through shared infrastructure, coding patterns, and monetization strategies. This comprehensive analysis connects individual attacks, including Master134, Fake Browser Updates, and CountsTDS, into a cohesive timeline revealing their evolution and interrelation.
DollyWay v3 predominantly targets visitors of infected WordPress sites by injecting redirect scripts. These scripts lead traffic to various scam pages via VexTrio, a notable cybercriminal affiliate network. While current operations mainly generate revenue through redirections, earlier iterations included aggressive payloads like ransomware and banking trojans.
The intricate operational structure of DollyWay employs several distinct infection techniques. The malware integrates multiple obfuscation layers, ensuring stealth. The first injection stage uses the WordPress wp_enqueue_script function to add a script that appears benign but hides true malicious activity. The second stage collects referrer information dynamically to prevent detection while guiding traffic towards specific scam sites.
The TDS systems employed by DollyWay randomly select from a list of infected nodes to direct users to various scams, categorized under several topics such as Dating, Mainstream (Sweepstakes), Crypto, Gambling, and more. Current configurations indicate that DollyWay uses about 14 nodes, updating their list and injection strategies daily, adapting to shifts in operational security measures.
A major characteristic of the malware is its reinfection capabilities. Every time a page is accessed on a compromised site, DollyWay executes an automated reinfection sequence focusing on disabling security measures, evading detection, and ensuring contamination of active plugins and WPCode snippets. It employs a variant renaming strategy and obfuscates its malicious scripts to evade static analysis tools.
Moreover, attackers establish malicious admin accounts using random hexadecimal usernames, which they create to bypass detection when regular admin users are removed. Regular monitoring of user credentials is conducted by intercepting login POST data, and this information is stored for potential exploitation.
DollyWay implements sophisticated backdoor techniques to maintain persistent access. The attack strategy includes listening for specific HTTP requests to create PHP files, execute arbitrary code, and enforce file integrity verification, ensuring that only the sanctioned code operates within the compromised sites.
Maintenance scripts, identified as wpu.php and cpl.php, play crucial roles, facilitating WordPress updates and malware installation or reinstallation processes. The complexity of these scripts highlights the attackers’ focus on ensuring that their malware persists and adapts to the management of the underlying software environment on infected sites.
By continually evolving tactics and exploiting legitimate web infrastructure features, the DollyWay campaign demonstrates an alarming level of sophistication and resilience. The operational continuity of this malware underscores the necessity for robust security measures to protect WordPress sites and other web platforms from such sophisticated threats.
Ultimately, the DollyWay operation highlights the ongoing sophistication of cyber threats, the need for constant vigilance, and the significance of understanding malware evolutions to enhance defensive measures effectively. Future analyses will further investigate the C2/TDS configurations and explore how DollyWay has adapted through various iterations, solidifying its pervasive threat in the cybersecurity landscape.