Server Mistake Exposes StopAndProtect’s Hacked WordPress Network
A configuration error by the criminals behind a malware campaign called StopAndProtect accidentally exposed their own infrastructure, revealing a network of nearly 2,000 compromised WordPress sites used to spread malware, steal files, and deploy ransomware. Check Point Research identified and investigated the operation after first detecting its ransomware in May 2026.
Why this matters: Nearly 2,000 hacked WordPress sites is not a small side operation. It means legitimate-looking websites were quietly turned into traps, and ordinary visitors had no way to know. If you run a WordPress site, someone may have used it against your own users. If you visited one, your files may have been at risk. The criminals exposed themselves through sloppiness, which is how many of these networks get caught. That is not a security strategy anyone should rely on.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.