THREATOPS
THREAT OPSThreat News › Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

medcheckpoint_researchPublished 2026-08-18

<p class="wp-block-paragraph">Research by: Jaromír Hořejší (<a href="https://x.com/JaromirHorejsi">@JaromirHorejsi</a>)</p>

<h2 class="wp-block-heading">Key points</h2>

<ul class="wp-block-list"> <li>StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to s

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/