GEO CODE: its corporate site was tampered with through a flaw in WordPress, and visitors on smartphones were redirected to an outside site

1. 2021-05-07 11:00

   Around this time, the company noticed that its corporate site could not be reached, stopped the server and investigated. [1]

2. 2021-05-12

   The company published its investigation results. [2]

The intrusion most likely came through WordPress, which builds the site, from access routed through an Indonesian IP address. The rented server's version did not match the latest WordPress, so patching lagged and a flaw remained. Malicious code that redirects to another site was planted in some of the site files. The site could not be viewed on a PC, and on a smartphone visitors were sent to what looked like an e-commerce site. What that destination site was is unknown. [1] [2]

The company said the damage was limited to the redirect tampering and that there was no sign of malware spread or use as a stepping stone. It said customer information is managed on a separate server and did not leak, and that its cloud services run on separate servers without WordPress and were not affected. To prevent a recurrence it will keep WordPress up to date and make a WAF mandatory. [2]