Forensic Investigation Report: Brilliant Light Power Security Breach

This report compiles the timeline, entry vectors, backdoor accounts, and attack details discovered during the forensic analysis of the security breach on brilliantlightpower.com.

1. Timeline of Key Events

2. Attacker Profile & Backdoors Found

Backdoor 1: Primary Account (wp.admin)

• User ID: 13
• Username: wp.admin
• Email: [email protected] (Warning: .st top-level domain mimics legitimate WordPress domains to bypass visual review)
• Registration Date: June 10, 2026 at 19:16:16 UTC
• Capabilities: administrator (User Level 10)
• Evidence Location: Backup from June 23, 2026 19:59:06 UTC (yblp_users and yblp_usermeta tables)
• Status: Deleted on June 25, 2026 by Wordfence.

Backdoor 2: Persistent Backup Account (sys_maint)

• User ID: 14
• Username: sys_maint
• Email: [email protected]
• Registration Date: June 21, 2026 at 14:16:09 UTC
• Capabilities: administrator (User Level 10)
• Evidence Location: Backup from June 23, 2026 19:59:06 UTC (yblp_users and yblp_usermeta tables)
• Status: Deleted by the June 24 rollback (since it was created after the June 14 restore checkpoint).

Backdoor 3: Automated Bootloader script (00-bootstrap.php)

• File Path: public_html/wp-content/mu-plugins/00-bootstrap.php
• Modification Date: June 21, 2026 at 14:16:09 UTC (7:16:09 AM PDT)
• Evidence Location: Hostinger File Backup June 21, 2026 12:46:00 PDT
• Status: Deleted by the June 24 rollback.

3. Forensic Evidence

A. Vulnerability Vector (MainWP Child Plugin)

The attacker exploited CVE-2026-27366 (vulnerability in MainWP Child plugin versions <= 6.1.1). When unique ID verification was disabled in settings, the plugin permitted passwordless administrative connection authentication.

B. Attacker Activity Logs

Our analysis of the WordPress changes log database table (yblp_mainwp_child_changes_logs) from the compromised snapshots (June 14 Backup and June 23 Backup) recorded the following operations:

1. Log ID 135078 & 135079 (June 10 at 12:16:16 PM PDT): Attacker exploits CVE-2026-27366 remotely from IP 104.28.159.169 (Cloudflare VPN) to programmatically register user wp.admin and escalate its capabilities to Administrator.
2. Log ID 149663 (June 21 at 07:15:21 AM PDT): Attacker uploads plugin archive file-manager-for-work2.zip.
3. Log ID 149665 (June 21 at 07:15:21 AM PDT): Attacker registers the plugin “File Manager for Work” (version 4.2.1, author: “Your Name”).
4. Log ID 149667 (June 21 at 07:15:26 AM PDT): Attacker activates file-manager-for-work2/file-manager-for-work2.php.
5. Log ID 149670 (June 21 at 07:16:09 AM PDT): Must-Use bootloader 00-bootstrap.php triggers and programmatically registers the persistent user sys_maint.

C. Must-Use Backdoor Loader Analysis (00-bootstrap.php)

We successfully isolated and analyzed the backdoor loader script 00-bootstrap.php (stored at /home/u268178543/forensics/00-bootstrap.php on the server). Because it was placed in wp-content/mu-plugins/, WordPress automatically loaded and executed it on every single page request. The file contains several layers of malicious logic:

1. Persistent Administrator Account Creation: The script contains hardcoded hex-encoded credentials for a backup administrator user:
   • Username: sys_maint
   • Email: [email protected]
   • Password: ChangeMe_Str0ng! On every admin_init hook trigger, the script checks if a user associated with the _wp_ip meta key exists. If not, it automatically runs wp_create_user() to recreate the account and escalates its capabilities to administrator. This acts as an “auto-heal” backdoor mechanism if the account is manually deleted.
2. Stealth and Hiding Mechanisms: To prevent administrators from noticing the sys_maint user in the WordPress dashboard:
   • It hooks into the pre_user_query action and modifies the database query WHERE clause: AND {$wpdb->users}.ID NOT IN ( SELECT user_id FROM {$wpdb->usermeta} WHERE meta_key = ‘_wp_ip’ AND meta_value = ‘1’ ) This filters out the sys_maint user from appearing in the dashboard’s Users list.
   • It hooks into the REST API rest_user_query filter to ensure the account cannot be queried or listed via public or private API requests.
3. Admin Evasion and Target Filtering: The payload injection function _wp_ip_inject is hooked to wp_head and wp_footer. It checks the environment before serving the script:
   • It returns immediately if the requested page is wp-login.php to avoid messing with authentication screens.
   • It returns immediately if a user is logged in and has administrative capabilities (current_user_can(‘manage_options’)), meaning logged-in administrators were entirely blind to the redirect script when testing the site.
4. Web3-Spoofing Malware Payload: The loader injects a large obfuscated JavaScript block that we decrypted using a Node.js sandbox runner. The payload targets Windows desktop visitors to serve them fake Captcha prompts and clip-stealers. The deobfuscated connection endpoint used by this script is:
   • https://bsc-1.node.tnet-drpc.com
   • Evasion Strategy: The domain is specifically crafted to mimic Web3/blockchain services (Binance Smart Chain bsc-1, decentralized RPC provider drpc, and testnet tnet) to bypass basic domain name blacklist scanners and look like legitimate cryptomining or blockchain connection calls in network activity logs.

D. HTTP Access Logs & Database Changes Logs Correlation

Our down-to-the-second forensic analysis of the attacker’s web access logs (http_log_176.124.220.186.tsv) and the database audit table (yblp_mainwp_child_changes_logs) revealed several critical findings:

1. Precision Execution Speed: The entire intrusion on June 21 took exactly 2 minutes and 7 seconds (from the 07:14:56 load of wp-login.php to the 07:17:02 deletion of the File Manager plugin). Below is the precise, down-to-the-second sequence of user actions extracted by correlating access logs and database audit logs:
   • 07:14:56 PDT: Attacker loads the /wp-login.php page.
   • 07:15:05 PDT (9 seconds later): Attacker submits the login form (POST /wp-login.php), logging in successfully as wp.admin.
   • 07:15:12 PDT (7 seconds later): Attacker clicks and navigates to the Plugins list (/wp-admin/plugins.php).
   • 07:15:14 PDT (2 seconds later): Attacker clicks “Add New” (/wp-admin/plugin-install.php).
   • 07:15:22 PDT (8 seconds later): Attacker uploads the plugin archive (POST /wp-admin/update.php?action=upload-plugin).
   • 07:15:27 PDT (5 seconds later): Attacker opens the new File Manager interface (/wp-admin/admin.php?page=fmfw-file-manager).
   • 07:15:28 PDT (1 second later): The File Manager UI initializes, sending its first AJAX request (POST /wp-admin/admin-ajax.php).
   • 07:16:08 PDT (40 seconds later): Attacker navigates the File Manager filesystem tree to the wp-content/mu-plugins/ directory and uploads/writes the backdoor loader script 00-bootstrap.php.
   • 07:16:09 PDT (1 second later): The next AJAX request sent by the File Manager bootstraps WordPress, automatically running the newly created Must-Use plugin 00-bootstrap.php. The script auto-initializes and programmatically registers the backup user sys_maint as an Administrator.
   • 07:16:33 PDT (24 seconds later): Attacker loads the homepage (GET /) in another tab to check if the site is alive or broken.
   • 07:16:39 PDT (6 seconds later): Attacker’s browser requests GET /null. This is a signature of their injection script’s admin-evasion code failing to load config values for logged-in admins, throwing a JavaScript error.
   • 07:16:59 PDT (20 seconds later): Attacker finishes their last file manager action.
   • 07:17:02 PDT (3 seconds later): Attacker deletes the File Manager plugin.
2. Reconnaissance Logins without Database Footprint: Before performing the file manager write, the attacker logged in as wp.admin twice on the morning of June 21, shifting through different routes/VPNs:
   • 05:10:45 PDT from 104.28.194.5 (Cloudflare Warp / VPN)
   • 06:01:07 PDT from 98.122.0.237 (US Residential ISP)
   • 07:15:05 PDT from 176.124.220.186 (Finland host, when the files were written) By parsing the database changes logs, we verified that no database changes, settings edits, or plugin installations occurred during the first two sessions. The attacker logged in purely to check if their credentials were still active and scan for active security measures before deploying the payload.
3. Forensic Value of the /null Evasion Signature: During the active compromise period (June 21 – June 22), the logs show multiple GET /null (404) requests from the attacker’s IP right after loading the homepage. This was a direct side effect of their obfuscated redirection script: it was configured to return null and return early for logged-in administrators to hide itself. This resulted in a JavaScript error on the admin’s browser, triggering a request to /null. On June 25 (today), the attacker returned twice to check the site (02:07:46 PDT and 02:23:12 PDT), but no /null requests were triggered. This provides definitive behavioral confirmation that the backdoor script has been successfully removed and the front-end JS redirection is completely dead.

4. Data Source Reference

This section details the nature, origin, and decoded timestamps of each evidence file used in this forensic analysis.

Summary Table of Data Sources

Detailed Explanations

1. Downloaded SQL Database Backups (.sql.gz files)
   • Nature: These files are compressed (gzip) exports of the entire WordPress database (containing tables for posts, options, users, logs, etc.). They are generated automatically by Hostinger’s backup infrastructure.
   • Decoding Filenames: The filenames follow the pattern [database_username].[YYYYMMDDHHMMSS].sql.gz.
     • E.g., u268178543_wp_brlp.20260607180605.sql.gz is decoded as:
       • Year: 2026
       • Month: 06 (June)
       • Day: 07
       • Hour: 18 (6 PM)
       • Minute: 06
       • Second: 05
       • Timezone: UTC (Coordinated Universal Time).
2. Live Server Database Captures (.sql files)
   • Nature: These are uncompressed, raw SQL dumps generated manually on the live production server via command line (mysqldump) for direct inspection.
   • Caution: Although named db_clean.sql and db_infected.sql by the user/administrator, forensic analysis shows both dumps were generated on June 25, 2026, after the initial June 24 rollback. Therefore, they are live captures representing the state after rollback but before final Wordfence cleanups.
3. Hostinger Filesystem Backup Snapshots
   • Nature: These are full virtual file system backups maintained by Hostinger’s servers. They capture all folders, PHP files, plugin scripts, themes, and configuration settings as they existed on the server disk at the time of backup. Individual files or folders are downloaded from them via the hPanel web UI.
4. Local Email Files (.eml files)
   • Nature: Standard raw email client files containing full text body, attachments, routing headers, and email timestamps. They represent the administrative correspondence discussing the compromise.
5. Attacker Reconnaissance Logs (http_log_other.txt)
   • Nature: Plain text copy of Hostinger server access logs representing visits from IP addresses other than the primary Finland attack vector.
   • Forensic Value: Proves that the wp.admin account was accessed for login validation twice before the payload write, showing VPN and ISP hopping patterns.

Report compiled on June 25, 2026.