Compromised WordPress Sites Distribute Adwind RAT

Zscaler ThreatLabZ documents a campaign (since April 2020) where attackers compromise WordPress sites to host multi-layer encrypted JAR files that ultimately deploy the Adwind (jRAT) remote access Trojan; the report includes detailed multi-stage decryption analysis, attribution to the Qarallax crypting service, MITRE ATT&CK mapping, and extensive IOCs (URLs, hashes, IPs) to aid detection and response.