AccessPress add-ons created backdoors

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0172 Runtime backdoor
T0184 Harvesting sensitive information from files

supply-chain campaign

T0172 · Execution · Runtime backdoor

Backdoor/RAT payload documented by the cited sources.

T0184 · Credential Access · Harvesting sensitive information from files

Credential or wallet material targeted.

Sources

https://jetpack.com/resources/backdoor-found-in-themes-and-plugins-from-accesspress-themes/
https://blog.sucuri.net/2022/01/accesspress-themes-hit-with-targeted-supply-chain-attack.html
https://arstechnica.com/information-technology/2022/01/supply-chain-attack-used-legitimate-wordpress-add-ons-to-backdoor-sites/
https://its.ny.gov/2022-012