Abuse of hidden “well-known” directory in HTTPS sites

ThreatLabZ detected hundreds of compromised WordPress and Joomla sites that attackers are abusing the .well-known ACME/pki-validation directories to host and persist malicious content: obfuscated HTML/JavaScript redirectors and ZIPs lead to a packed Shade/Troldesh ransomware binary (delivered via JS and ZIP attachments) that drops a Tor client, registers persistence, and encrypts files using AES-256 and RSA; the report includes infection-chain analysis, artifacts (registry keys, filenames, ransom notes), telemetry on phishing vs. ransomware distribution, and an extensive list of IOCs for detection and remediation.