Social Warfare plugin created backdoors

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0172 Runtime backdoor
T0184 Harvesting sensitive information from files
T0111 Malicious code contribution to an open-source repository

supply-chain campaign

T0172 · Execution · Runtime backdoor

Backdoor/RAT payload documented by the cited sources.

T0184 · Credential Access · Harvesting sensitive information from files

Credential or wallet material targeted.

T0111 · Resource Development · Malicious code contribution to an open-source repository

Malicious code in distributed plugin/mod packages.

Sources

https://www.wordfence.com/blog/2024/06/supply-chain-attack-on-wordpress-org-plugins-leads-to-5-maliciously-compromised-wordpress-plugins/
https://plugins.trac.wordpress.org/changeset/3105893/
https://cveawg.mitre.org/api/cve/CVE-2024-6297
https://wpscan.com/vulnerability/2c9eb68a-bf19-42df-9c71-f85c440225bc/