FleetSync PHP backdoor

A controller assigns work to WordPress sites

FleetSync's PHP reads its controller address through eth_call to a BNB Smart Chain testnet contract. It tries several public RPC services, decodes the reply and builds a request to the controller with a random subdomain. The request identifies the site and sends an inventory of WordPress, PHP, cache plugins and planted files.

The task handler, _ea_run_task, executes supplied PHP, overwrites or appends to files, installs code and clears caches. Each task returns an acknowledgement with its result or error. The implant registers an ea_fleet_sync cron event and calls its sync routine from WordPress's init hook.

The theme hook grants a logged-in session

FleetSync's fn task walks the installed themes and appends a supplied snippet to each functions.php that lacks the // _ea_al marker. Its inventory reports how many themes carry that marker and checks must-use plugins and wp-config.php for other planted code.

The autologin snippet accepts ?al=true. For a logged-out request, it selects an administrator, falls back to an editor if needed, sets a WordPress authentication cookie and redirects to the dashboard. Removing the polling implant leaves this separate route into the site if the theme hook remains.

What we see

Month	New sites
September	778
October so far	27

Among successful captures since 25 September, 137 of 242 FleetSync sites ran WordPress.

Checking a WordPress site

Compare plugin, must-use plugin and theme PHP with trusted copies. Look for:

• _ea_run_task, _ea_sync and _ea_inv
• the ea_fleet_sync scheduled event and ea_fleet cron schedule
• // _ea_al and an al parameter check in theme functions.php
• wp_set_auth_cookie followed by a redirect to admin_url()
• functions_autologin, mu_autologin and wpconfig_inject in an inventory routine
• PHP that reads a controller through eth_call and posts site inventories or task acknowledgements

Remove the polling code, its cron event and every planted hook. Restore changed PHP from trusted copies, review WordPress and hosting access, rotate credentials and invalidate active sessions. Check every installed theme and adjacent site under the same hosting account.