Search — “43.250.53.42”
1 story · 1 IoC
Stories
P1
Stolen UpdraftCentral cloud keys used to install backdoor plugins on WordPress sites
A breach of teamupdraft.com (17-18 Oct 2026) exposed UpdraftCentral/UpdraftVault/UpdraftClone connection keys; attackers used valid UpdraftCentral dashboard keys to send signed plugin.upload_plugin commands via POST to the site root, installing backdoor plugins disguised as maintenance tools. The backdoor creates privileged accounts (e.g. data-ops43) triggered by the ?_9f5696= parameter, and later variants create full admins. Hunt for POSTs to site root carrying UpdraftCentral RPC commands from 43.250.53.42 / 2a09:bac5:4e21:2e3c::49b:9, unknown plugins (incl. mu-plugins) containing 'Small maintenance toolkit: keeps option storage tidy.', and new admin/editor accounts with @example.com emails.
IoCs
| ipv4 | 43[.]250[.]53[.]42 | seen 1×, first 2026-10-21 13:04Z | Source of UpdraftCentral backdoor commands · 2026-10-21 |