StopAndProtect Ransomware Crew Exposed by Check Point OPSEC Failure: Nearly 2,000 Compromised WordPress Sites Form Global Crime Infrastructure

Check Point Research discloses a StopAndProtect ransomware crew OPSEC failure exposing 31,000 victim-host screenshots, a list of nearly 2,000 hijacked WordPress domains, and Visual Basic 6 source for internal automation tools. The crew uses ClickFix fake CAPTCHA to deliver multi-stage PowerShell/.NET payloads. 5,000+ victims. IPs concentrated in the United States, Russia, and India.

Check Point Research published a deep-dive investigation on 18 August 2026 exposing ransomware crew StopAndProtect after an OPSEC failure dumped its internal infrastructure: a list of nearly 2,000 compromised WordPress domains, 31,000 victim-host screenshots, and Visual Basic 6 source for an internal automation tool. Researchers Jaromír Hořejší and Eli Smadja report the crew used ClickFix fake CAPTCHA to have victims copy-paste a PowerShell command, launching two-stage PowerShell plus two-stage .NET loaders, then landing the full kit: encryptor, SMB/USB worm, locker, credential stealer, VBS spreader, and a one-to-one chat tool.

Incident Overview

StopAndProtect originated as an encryptor filename. Check Point adopted it as the operation codename because the crew does not encrypt every host: some cases only silently enumerate sensitive directories and exfiltrate on demand—an industrial model of stage first, monetize by value later. Check Point reached large volumes of logs and screenshots via a PHP directory-enumeration script on a hijacked WordPress site, then recovered VB6 source for a tool that manages 2,000 WordPress sites from a desktop that an operator apparently self-infected. Those sites were reused as payload hosting, C2 command distribution, and victim-data storage—a decentralized crime network.

Technical Details

• ClickFix entry: victims on compromised WordPress sites see a fake CAPTCHA that asks them to paste a PowerShell command to prove they are not a robot. The command then fires two-stage PowerShell scripts and a multi-stage .NET loader, all base64 / in-memory to evade static detection.
• WordPress persistence: the crew deploys a disguised plugin that auto-disables and deletes itself, then writes a must-use plugin at `wp-content/mu-plugins/wp-sec.php`. Must-use plugins load on every request and do not appear in the plugin list.
• Hidden REST endpoint: the must-use plugin registers a hard-coded-credential-protected `wp-sec/v1/upload` endpoint that allows .php upload to any WordPress directory—direct RCE.
• Tooling: encryptor, SMB/USB worm, locker, credential stealer, VBS spreader, and a remote one-to-one chat tool with victims, packaged as a modular plug-and-play crime kit.
• Scale: ~5,000 victim-host IPs in the logs, concentrated in the United States, Russia, and India, with visible density in parts of Western Europe and Southeast Asia.

Impact Assessment

The report flags one compromised WordPress site still running a 2021 core release, with ~40 distinct vulnerabilities scanned: expired certificates, SQL injection, open redirect, auth bypass, authenticated arbitrary file upload. As of 2026 WordPress holds over 43% of global website market share. The ecosystem is large and plugins are fragmented. StopAndProtect turned that unmaintained-at-scale baseline into built-in infrastructure, skipping VPS rental, domain purchase, and certificate issuance. Check Point's forensic value goes beyond IOCs: the self-infected desktop leaked internal tools that let researchers reconstruct the full site-management panel and payload-switching flow—a rare 2026 RaaS case of reverse-engineering the crime side, and a benchmark for supply-chain attribution research.

Remediation

• Audit `wp-content/mu-plugins/` immediately. Delete any non-owned, unfamiliar PHP files. Watch for `wp-sec.php` and unknown endpoint registration in `wp-content/mu-plugins/*.php`.
• Upgrade WordPress core, themes, and all plugins to the latest stable releases. Disable plugins unmaintained for more than 12 months. Check the admin console for suspicious administrator accounts and unknown roles.
• Add WAF / web-server rules blocking `/wp-sec/v1/upload` and suspicious POSTs with long base64 strings or PowerShell invocation. Enable PHP `disable_functions` to restrict exec / system / passthru.
• Enable PowerShell Constrained Language Mode and ScriptBlock logging on enterprise endpoints. Add ClickFix patterns to EDR. Alert on browser-process parent chains spawning powershell.exe.
• Train users against ClickFix social engineering. Any CAPTCHA that requires copy-pasting a command outside the browser is a scam.

References

• Check Point Research The Mistake That Exposed a Global Cyber Crime Operation
• SIT-CyberSecurity Thousands of Hacked WordPress Sites, One Operation
• Hackers Radar WordPress Sites Hijacked for StopAndProtect Malware C2
• IntelFusions A ransomware crew left its victim screenshots wide open