CryptoPHP: Analysis of a hidden threat inside popular content management systems

CryptoPHP is a large-scale campaign that distributes backdoored Joomla, WordPress and Drupal themes and plugins (often pirated) to install a persistent backdoor on webservers; the backdoor supports public-key encrypted C2, email-based fallback mechanisms, manual operator control, remote updates, and has been found in thousands of compromised sites used for blackhat SEO.