Attackers who breached the website of TeamUpdraft, the developer of the UpdraftPlus backup plugin for WordPress, are using stolen remote-management keys to install backdoors on customer sites. The company detected unauthorised access over the weekend of 17 and 18 October, says it worked through the night to contain it and has replaced the affected keys and credentials.
What was taken
TeamUpdraft believes the intruder reached a customer database holding contact and billing details, order history, password hashes, two-factor settings and the connection keys for its UpdraftCentral, UpdraftVault and UpdraftClone services. It says it held no payment card details, that plugin files and downloads were not tampered with, and that self-hosted UpdraftCentral installations are unaffected.
The attacks
A WordPress security researcher said the attacks began on 18 October at 15:32 UTC, run arbitrary code and add full administrator accounts, and may be more serious than an earlier large campaign. At least 99 malicious plugins have been logged, disguised under maintenance-style names. A second research team documented a newer backdoor that can create privileged accounts or log in as an existing administrator, and reported that attackers signed their commands with valid private keys, so the targeted servers were never broken into directly. It also said the company's first fix, version 1.26.12 and 2.26.12, was meant to remove the cloud keys but failed because of a bug.
Roughly one in ten UpdraftPlus sites is thought to hold an UpdraftCentral or Migrator key, which would put around 400,000 sites at risk. That is an estimate, not a confirmed count, and the attacker has not been identified.
What site owners should do
Site owners are advised to update to version 1.26.13 (free) or 2.26.13 (premium) or later, delete existing connection keys in the plugin's advanced settings and rotate storage credentials. A site found to be compromised should be restored from a clean backup, with the TeamUpdraft account password changed, all sessions revoked and two-factor authentication reset.
