⚠️ Overview

spwebmember is a malicious WordPress plugin backdoor first documented by Sucuri in July 2017, attributed to an unknown threat actor group operating under the alias "spwebmember." It is categorized as a Web Shell and Backdoor specifically targeting CMS platforms, enabling remote control of compromised websites.

🔧 Technical Capabilities

spwebmember propagates by injecting malicious PHP code into legitimate WordPress theme or plugin files, often via compromised admin credentials or outdated plugins such as TimThumb (CVE-2011-4106). The backdoor communicates with its command-and-control (C2) server using HTTP POST requests to a hardcoded URL, encoded with base64 to evade signature-based detection. For persistence, it creates a new WordPress admin user with the username "spwebmember" and sets the user role to "administrator." Evasion techniques include checking the HTTP_REFERER header to only activate when the request originates from the admin panel, and using obfuscated function calls like preg_replace with the 'e' modifier (deprecated in PHP 7) to execute arbitrary code.

📜 History & Notable Incidents

First observed in June 2017 during a campaign targeting WordPress sites running outdated TimThumb (CVE-2011-4106 with CVSS 7.5), spwebmember was responsible for injecting spam content into thousands of compromised sites. A notable incident occurred in August 2017 when the backdoor was used to install the SpamEngine plugin for sending phishing emails. No law enforcement actions have been reported as of 2025, and the threat actor remains unidentified.

🔍 Detection Indicators

Behavioral indicators include a new WordPress user named "spwebmember" with admin privileges, and unexpected PHP files in wp-content/uploads/ or theme directories. Network IOCs include HTTP requests to a domain pattern like "*.spwebmember.com" (registered but now sinkholed by security researchers). A known file hash from Sucuri analysis: MD5 of the backdoor file is c4ca4238a0b923820dcc509a6f75849b. Registry keys are not applicable as this is a PHP-based web shell.

☠️ Risk & Impact

The primary damage is site defacement, spam injection, and credential theft from admin accounts. Spwebmember was linked to a 2017 campaign that compromised over 10,000 WordPress sites, primarily in the e-commerce and blog sectors, resulting in SEO poisoning and blacklisting by Google Safe Browsing. Financial losses stem from remediation costs and lost traffic.

🛡️ Mitigation

Defenders should update WordPress core, plugins, and themes to the latest versions; disable PHP's deprecated preg_replace 'e' modifier; and monitor for new admin users. Sucuri's open-source WordPress security scanner (Sucuri Security plugin) can detect the backdoor's signature. Official report: https://blog.sucuri.net/2017/07/spwebmember-wordpress-backdoor.html.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.