Last seven days
- First activity
- Sep 30, 2026
- Last activity
- Sep 30, 2026
- Feed role
- Distribution
- Host form
- 0 IP / 1 hostnames
StopAndProtect
StopAndProtect is a multi-component cybercrime malware operation first identified in May 2026 that combines ransomware with covert data theft and post-compromise surveillance.
Profile source: Mallory opens in a new tabStopAndProtect
Family profile
StopAndProtect is a multi-component cybercrime malware operation first identified in May 2026 that combines ransomware with covert data theft and post-compromise surveillance. The operation is notable for abusing large numbers of compromised WordPress websites as distributed infrastructure for malware hosting, command and control, and storage of exfiltrated victim data. Infection commonly begins with a ClickFix-style fake CAPTCHA lure on hacked WordPress sites that tricks victims into executing a PowerShell command, leading to a staged infection chain involving PowerShell scripts and .NET downloaders and loaders.
The toolkit associated with StopAndProtect includes a ransomware component known as SilentEncryptor, a stealer known as SilentDataCollector, an SMB and USB propagation component, a VBS spreader, a lock-screen ransom module, and a custom chat utility for operator-victim interaction. Reported capabilities include targeted file inventory and exfiltration, credential theft, keylogging, screenshot capture, network share discovery and mapping, scraping of local communication data including WhatsApp-related information, and selective deployment of encryption. Available reporting indicates the operators often prioritize reconnaissance and theft before deciding whether to encrypt systems, and ransomware is not deployed against every victim.
The operation also leveraged malicious WordPress plugins and must-use plugins to maintain access to compromised sites and enable arbitrary file upload, supporting persistent reuse of hacked web infrastructure. Exposed operational data indicated global victimization, with particularly high concentrations observed in the United States, Russia, and India, and showed that the campaign targeted organizations worldwide rather than a single sector. StopAndProtect is best characterized as a modular double-extortion ransomware operation with substantial infostealing, surveillance, lateral movement, and hands-on-keyboard post-exploitation functionality.
Capabilities
- Credential Theft
- Exfiltration
- Extortion
- Keylogging
- Lateral Movement
- Persistence
- Post Exploitation
- Process Injection
- Reconnaissance
Observed infrastructure
Leading locations
- SG1
Leading providers
- OVH SAS1
Infrastructure traits
- Hosting 1
Samples
Recent associated samples
MITRE ATT&CK
StopAndProtect in ATT&CK
38 distinct techniquesTechniques
38 techniques T1102 Web Service T1204.002 Malicious File T1027 Obfuscated Files or Information T1543 Create or Modify System Process T1547 Boot or Logon Autostart Execution T1059.001 PowerShell T1071.001 Web Protocols T1041 Exfiltration Over C2 Channel T1566 Phishing T1105 Ingress Tool Transfer T1584.004 Server T1497 Virtualization/Sandbox Evasion T1083 File and Directory Discovery T1113 Screen Capture T1059.005 Visual Basic T1021.002 SMB/Windows Admin Shares T1091 Replication Through Removable Media T1071 Application Layer Protocol T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1074 Data Staged T1555 Credentials from Password Stores T1204 User Execution T1047 Windows Management Instrumentation T1135 Network Share Discovery T1119 Automated Collection T1570 Lateral Tool Transfer T1056.001 Keylogging T1005 Data from Local System T1036 Masquerading T1649 Steal or Forge Authentication Certificates T1537 Transfer Data to Cloud Account T1566.002 Spearphishing Link T1505.003 Web Shell T1620 Reflective Code Loading T1059 Command and Scripting Interpreter T1497.001 System Checks T1204.003 Malicious Image
Reporting
Research mentioning StopAndProtect
Aug 18
Itsecurityguru
2,000 Hacked WordPress Sites Were Secretly Running a Global Crime Ring - IT Security Guru
Check Point Research uncovered StopAndProtect, a large-scale cybercrime operation that used compromised WordPress sites to host malware, provide command-and-control, and store stolen data. The campaign began with a ClickFix fake CAPTCHA lure that tricked victims into launching PowerShell, then deployed multiple .NET loader stages that installed a broad toolset including SilentEncryptor ransomware, the SilentDataCollector stealer, an SMB/USB worm, a VBS spreader, a lock-screen module, a credential stealer, and a custom chat utility for interacting with victims. Researchers said the operators made significant OPSEC mistakes that exposed their infrastructure, including open PHP directory listings, accessible log and screenshot folders, and archived files that appeared to show the actors had infected themselves. Those leaks revealed source code and operational files used to mass-manage compromised WordPress domains. Monitoring from mid-May through late July 2026 found more than 700 stolen-data archives and about 31,000 victim screenshots, while internal logs and exposed systems indicated the campaign hit thousands of IP addresses worldwide, with the highest concentrations in the United States, Russia, and India.
Aug 18
Checkpoint Research
