OFFSEQ MIRAGE FIELD REPORT 004
The backdoor inside the backup request
Analysis cutoff: 2026-09-06 16:20:00 UTC

Report:
https://offseq.com/en/research/the-backdoor-inside-the-backup-request/

WHAT THIS BUNDLE CONTAINS

request-timeline.csv contains the 24 retained RPC requests in timestamp order.
evidence.json contains the same records, correlation method, artifact hashes,
scope and limitations. Numeric counts represent retained requests, not victims.
offseq-updraft-webshell.yar is a sample-specific file-triage rule.
campaign-timeline-en.svg / .png and campaign-timeline-lv.svg / .png are figures
derived from the CSV. Close timestamps are separated vertically for legibility;
their horizontal positions preserve time. Four enumeration requests are grouped
at their first timestamp because their 2.030-second span is below this scale.

The public bundle contains no executable PHP, malicious ZIP, full forged RPC,
decoy hostnames, local private keys, internal sensor IDs or live credentials.

COUNTING AND CORRELATION

Scope: public Mirage edge personas; explicitly benign records and records marked
as originating from tenants excluded. Requests must precede the fixed cutoff.
The 24 RPC requests consist of 20 plugin.upload_plugin requests from 10 source
IPs and 4 plugin.load_plugins requests from one other source IP.

For each upload, match subsequent HTTP GETs from the same source IP to the same
requested hostname and the exact /wp-content/plugins/ + decoded ZIP member path.
The follow-up window ends at the earlier of upload + 24 hours or the cutoff.
All 76 matches also share their upload's internal session ID and have no query
string. Widening the search to other hostnames adds no exact-path matches.

Fourteen small-payload uploads have 4 checks each. Four larger-payload uploads
have 5 checks each. Two small-payload uploads have no retained match. The latest
upload has only 2 hours, 9 minutes and 16.239 seconds of follow-up before cutoff.
Enumeration requests have blank CSV counts / JSON null because no plugin path
was supplied; this is different from an upload with zero observed checks.

EVIDENCE QUALITY

For historical upload attempts, declared_php_bytes comes from a ZIP local file
header recovered through partial decryption/decompression of the body preview.
It is not a measurement of a fully recovered historical PHP file. The latest
6 September body, ZIP and PHP are complete and independently hashed.
Historical request-body hashes are values recorded by the collector; unavailable
historical full bodies could not be independently rehashed during this review.

The four enumeration RPC messages are complete in their retained previews.
The 19,741-byte payload is not fully recovered and is not covered by the YARA rule.
Source IPs and ASNs describe observed traffic and enrichment, not operator identity.
No payload was executed. GET checks do not prove installation, activation or RCE.

FORENSIC REPRODUCTION

The private collection retains the complete latest body addressed by its SHA-256.
The analysis parsed its form fields, decoded the RPC framing, decrypted available
AES blocks, parsed JSON, decoded the embedded ZIP and inspected members in memory.
SHA-256 values are recorded for each complete recovered layer. The original body
is not included here, so this public bundle supports checking counts, timings,
correlations and indicators; it is not a self-contained raw-payload reproduction.

The figure generator is scripts/research/plot-updraft-timeline.py in the site
source. It reads this CSV, requires Python 3 and Matplotlib, and generates both
localized SVG and PNG versions. It is independent of the website build.

DETECTION RULE

Scan isolated evidence copies with a trusted YARA installation. The rule requires
a PHP opening tag at byte zero, both characteristic marker/key strings, and at
least one gate/upload string. It intentionally misses variants that change these
strings or prepend bytes. A match is an investigation lead, not automatic proof
of compromise. A negative result does not establish a clean site.

The rule is evaluated against the recovered bytes without executing PHP.
Validation results and the negative comparison corpus are recorded in evidence.json.

SOURCE CREDIT

Campaign telemetry and static payload analysis: OffSeq Cybersecurity / Mirage.
Original vulnerability discovery: vtim through the Wordfence Bug Bounty Program.
Vendor remediation: TeamUpdraft. Public advisory and source links are in the report.

Readers quoting the findings should preserve the distinction between attempted
delivery to decoys and confirmed compromise of a real WordPress installation.