{
  "title": "The backdoor inside the backup request",
  "report_url": "https://offseq.com/en/research/the-backdoor-inside-the-backup-request/",
  "published": "2026-09-06",
  "analysis_cutoff_utc": "2026-09-06T16:20:00.000Z",
  "scope": "Retained unsolicited Updraft RPC requests on the public Mirage edge fleet; explicitly benign and tenant-origin records excluded.",
  "summary": {
    "retained_rpc_requests": 24,
    "upload_requests": 20,
    "enumeration_requests": 4,
    "source_ips": 11,
    "upload_source_ips": 10,
    "edge_personas": 8,
    "followup_gets": 76,
    "upload_paths_with_followup_gets": 18,
    "small_declared_php_members": 16,
    "larger_declared_php_members": 4,
    "fully_recovered_php_files": 1
  },
  "followup_method": "For each upload, match subsequent retained HTTP GETs from the same source IP to the same requested hostname and the exact /wp-content/plugins/ + decoded ZIP member path, after the upload and before min(upload+24 hours, cutoff). All 76 matches also share the corresponding internal session ID. No additional exact-path matches occurred on other hostnames in that window. All matched request targets had no query string. No observed match is not proof of no attempt or a failed install. Inventory requests have null counts because they declare no plugin path.",
  "evidence_note": "The declared PHP size for historical payloads comes from the ZIP local file header. Complete PHP contents and actual size are verified only for the latest September 6 raw object documented by this manifest. No payload was executed. Addresses are observed network sources, not operator attribution. Decoy hostnames, internal IDs and raw executable payloads are omitted.",
  "latest_complete_artifacts": [
    {
      "type": "http_post_body",
      "bytes": 4087,
      "sha256": "3b321d1d5568f32b0049682e935a4f6807096985e4aa857ec65cdde5fcf243a4"
    },
    {
      "type": "embedded_zip",
      "sha256": "8e8d88878379f0a6c640c99f48b0edf064761a6b79bb14aba553996aa143a59f",
      "bytes": 1976
    },
    {
      "type": "php_file",
      "member_path": "wp_zmfjlow/wp_zmfjlow.php",
      "bytes": 3686,
      "sha256": "ac87d574d74c854d1be68274a7915cfa5a3a6750ca3e89cec2ea02301d66cabe"
    }
  ],
  "detection": {
    "rule_file": "offseq-updraft-webshell.yar",
    "scope": "Sample-specific file triage for the fully recovered small PHP only. Not a vulnerability test, broad-family detector or compromise verdict.",
    "validation": {
      "engine": "yara-python 4.5.4",
      "date": "2026-09-06",
      "positive_sample_sha256": "ac87d574d74c854d1be68274a7915cfa5a3a6750ca3e89cec2ea02301d66cabe",
      "positive_sample_matched": true,
      "behavior_checks": "Essential-marker removal, optional-string changes, byte-zero constraint, short partial marker, and size bound checked without executing PHP.",
      "negative_reference_url": "https://downloads.wordpress.org/plugin/updraftplus.1.26.5.zip",
      "negative_reference_zip_sha256": "82c7e88b4fa24cb8b336a80199bbdb184f18e67b83530376cfe800b7a2f9a44b",
      "negative_reference_php_files_scanned": 843,
      "negative_reference_matches": 0,
      "limits": "A single legitimate package is a narrow comparison corpus, not a measured field false-positive rate. Variants changing required strings or prepending bytes may evade the rule."
    }
  },
  "records": [
    {
      "timestamp_utc": "2026-07-02T17:39:06.322Z",
      "src_ip": "107.189.14.87",
      "asn": 53667,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_xhxxodv.zip",
      "zip_entry": "wp_xhxxodv/wp_xhxxodv.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4105,
      "request_body_sha256": "b11c5b5f3a5361135d312457fcd9057515dae108e8fd62adcec9b838c26c8b13",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.676,
        2.381,
        3.22,
        4.136
      ],
      "followup_observation_end_utc": "2026-07-03T17:39:06.322Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-08T03:06:28.495Z",
      "src_ip": "193.148.56.148",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_mtgrxok.zip",
      "zip_entry": "wp_mtgrxok/wp_mtgrxok.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4113,
      "request_body_sha256": "1939ddf8b04db2088d06dabde93ea9364aaba5d71b5f0baa6fd93120490c3633",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.794,
        2.36,
        2.896,
        3.777
      ],
      "followup_observation_end_utc": "2026-07-09T03:06:28.495Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-09T00:00:49.085Z",
      "src_ip": "107.189.14.87",
      "asn": 53667,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_pcfjhve.zip",
      "zip_entry": "wp_pcfjhve/wp_pcfjhve.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4095,
      "request_body_sha256": "f57daf1ec12e80e08e356f8d60b4adb4fff9d858aedfc2cf609d17fbbe6d8ed1",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.661,
        2.466,
        3.119,
        3.804
      ],
      "followup_observation_end_utc": "2026-07-10T00:00:49.085Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-09T11:17:37.176Z",
      "src_ip": "193.148.56.148",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_karzzcd.zip",
      "zip_entry": "wp_karzzcd/wp_karzzcd.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4109,
      "request_body_sha256": "ba60c47b28031dfdc394106255d575c2ccf2fa70ca8d025e905368d30a1e581f",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.67,
        2.228,
        2.781,
        3.334
      ],
      "followup_observation_end_utc": "2026-07-10T11:17:37.176Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-09T15:25:53.149Z",
      "src_ip": "193.148.56.79",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_xiwwefa.zip",
      "zip_entry": "wp_xiwwefa/wp_xiwwefa.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4109,
      "request_body_sha256": "86d6e705f3d02e77158290b1ee4ea8ce4d41e6d8c21cdf983ccdb03873374651",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.928,
        2.611,
        3.985,
        5.772
      ],
      "followup_observation_end_utc": "2026-07-10T15:25:53.149Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-09T17:50:46.421Z",
      "src_ip": "193.148.56.134",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_yqvwxuw.zip",
      "zip_entry": "wp_yqvwxuw/wp_yqvwxuw.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4093,
      "request_body_sha256": "15adb16e94e71102673c4ac597662f97699e2c93bf69d3d54a5f81772c52c507",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.561,
        2.108,
        2.665,
        3.208
      ],
      "followup_observation_end_utc": "2026-07-10T17:50:46.421Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-09T18:04:21.878Z",
      "src_ip": "107.189.14.87",
      "asn": 53667,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_ipyrnuh.zip",
      "zip_entry": "wp_ipyrnuh/wp_ipyrnuh.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4099,
      "request_body_sha256": "c2dbd6476754521463c3666a39412b4be4ccf18d81c1a131c19fbeda29c3c867",
      "subsequent_exact_path_gets": 0,
      "followup_delays_seconds": [],
      "followup_observation_end_utc": "2026-07-10T18:04:21.878Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-10T13:43:53.704Z",
      "src_ip": "193.148.56.61",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_wqnnmtd.zip",
      "zip_entry": "wp_wqnnmtd/wp_wqnnmtd.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4103,
      "request_body_sha256": "1c23dc98e1a5e1ec05721c566a2127c5c129a2263ad0d396302c81f102276472",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.707,
        2.335,
        2.934,
        3.57
      ],
      "followup_observation_end_utc": "2026-07-11T13:43:53.704Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-10T18:44:57.766Z",
      "src_ip": "163.223.211.27",
      "asn": 150895,
      "command": "plugin.load_plugins",
      "zip_filename": null,
      "zip_entry": null,
      "declared_php_bytes": null,
      "request_body_bytes": 423,
      "request_body_sha256": "fb0ed590d09743846b3ddf5c013b012c344352b8f3ee9086dc488492f27687b7",
      "subsequent_exact_path_gets": null,
      "followup_delays_seconds": [],
      "followup_observation_end_utc": null,
      "evidence_extent": "complete_rpc_message_in_retained_preview"
    },
    {
      "timestamp_utc": "2026-07-10T18:44:58.758Z",
      "src_ip": "163.223.211.27",
      "asn": 150895,
      "command": "plugin.load_plugins",
      "zip_filename": null,
      "zip_entry": null,
      "declared_php_bytes": null,
      "request_body_bytes": 423,
      "request_body_sha256": "1afddfb5194bd9749a6d52018d7c54d7438c10403ac06a99d604eaabade1a007",
      "subsequent_exact_path_gets": null,
      "followup_delays_seconds": [],
      "followup_observation_end_utc": null,
      "evidence_extent": "complete_rpc_message_in_retained_preview"
    },
    {
      "timestamp_utc": "2026-07-10T18:44:59.295Z",
      "src_ip": "163.223.211.27",
      "asn": 150895,
      "command": "plugin.load_plugins",
      "zip_filename": null,
      "zip_entry": null,
      "declared_php_bytes": null,
      "request_body_bytes": 421,
      "request_body_sha256": "c09eca8634537bbae69fbef6d09cdbf3660b37e57b38a160fbfbcf0b40d40146",
      "subsequent_exact_path_gets": null,
      "followup_delays_seconds": [],
      "followup_observation_end_utc": null,
      "evidence_extent": "complete_rpc_message_in_retained_preview"
    },
    {
      "timestamp_utc": "2026-07-10T18:44:59.796Z",
      "src_ip": "163.223.211.27",
      "asn": 150895,
      "command": "plugin.load_plugins",
      "zip_filename": null,
      "zip_entry": null,
      "declared_php_bytes": null,
      "request_body_bytes": 416,
      "request_body_sha256": "af0b59f83b19060921d17f769d8be030ccc0231386657881c635d44b794e2445",
      "subsequent_exact_path_gets": null,
      "followup_delays_seconds": [],
      "followup_observation_end_utc": null,
      "evidence_extent": "complete_rpc_message_in_retained_preview"
    },
    {
      "timestamp_utc": "2026-07-11T04:44:30.638Z",
      "src_ip": "107.189.14.87",
      "asn": 53667,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_rsyiknw.zip",
      "zip_entry": "wp_rsyiknw/wp_rsyiknw.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4123,
      "request_body_sha256": "9e3cb048efb9057db3913835dcbda9636859aceda9d2aba4c47eb06e54d88ebb",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.709,
        2.293,
        2.855,
        3.969
      ],
      "followup_observation_end_utc": "2026-07-12T04:44:30.638Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-15T12:01:03.032Z",
      "src_ip": "193.148.56.148",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_apregiz.zip",
      "zip_entry": "wp_apregiz/wp_apregiz.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4135,
      "request_body_sha256": "e59adedb8fa385d5281888666ae304c972c6c50b88cdf129584b9e4208e20ca7",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.572,
        2.337,
        3.116,
        3.931
      ],
      "followup_observation_end_utc": "2026-07-16T12:01:03.032Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-15T20:10:37.489Z",
      "src_ip": "95.85.238.18",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_wtyzmmi.zip",
      "zip_entry": "wp_wtyzmmi/wp_wtyzmmi.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4121,
      "request_body_sha256": "75a73a96894dbbc7e04e5a31c04e3114029ffb28e63116712da79dbf92a98794",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.688,
        2.253,
        2.845,
        3.577
      ],
      "followup_observation_end_utc": "2026-07-16T20:10:37.489Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-17T03:05:55.892Z",
      "src_ip": "193.148.57.33",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_roqvzyz.zip",
      "zip_entry": "wp_roqvzyz/wp_roqvzyz.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4121,
      "request_body_sha256": "55f07bde63068d1f46d60742b1ca85309788c8c233a01a8956fc18027ed7cabc",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.65,
        2.241,
        2.791,
        3.489
      ],
      "followup_observation_end_utc": "2026-07-18T03:05:55.892Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-17T07:37:57.884Z",
      "src_ip": "193.148.56.148",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_ahzulfl.zip",
      "zip_entry": "wp_ahzulfl/wp_ahzulfl.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4105,
      "request_body_sha256": "500cb941d4f73192a8f9079bada75ee7c198134956f77affbb24ac68c8592783",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.692,
        2.319,
        2.924,
        3.607
      ],
      "followup_observation_end_utc": "2026-07-18T07:37:57.884Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-18T05:02:44.850Z",
      "src_ip": "193.148.56.61",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_cvapkca.zip",
      "zip_entry": "wp_cvapkca/wp_cvapkca.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4105,
      "request_body_sha256": "444ded3c7592d745d5a8c1266de5c88a023fb8a824cbd431e3baeb044bebfda5",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.656,
        2.217,
        2.763,
        3.317
      ],
      "followup_observation_end_utc": "2026-07-19T05:02:44.850Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-18T12:03:54.517Z",
      "src_ip": "193.148.56.148",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_ouastxm.zip",
      "zip_entry": "wp_ouastxm/wp_ouastxm.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4109,
      "request_body_sha256": "09502eecf10e308a13534ed40cd4dd63eb0a6865a48434514f7bb1f6ec9aae17",
      "subsequent_exact_path_gets": 4,
      "followup_delays_seconds": [
        1.668,
        2.237,
        2.806,
        3.356
      ],
      "followup_observation_end_utc": "2026-07-19T12:03:54.517Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-07-22T17:56:01.654Z",
      "src_ip": "95.85.238.18",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_fwiqmof.zip",
      "zip_entry": "wp_fwiqmof/wp_fwiqmof.php",
      "declared_php_bytes": 19741,
      "request_body_bytes": 11397,
      "request_body_sha256": "62d7066f85a397c912de62802653cfd441151377f1456ddac5fbc9865de77082",
      "subsequent_exact_path_gets": 5,
      "followup_delays_seconds": [
        1.675,
        2.802,
        3.657,
        4.51,
        5.373
      ],
      "followup_observation_end_utc": "2026-07-23T17:56:01.654Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-08-10T22:24:12.868Z",
      "src_ip": "45.13.186.114",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_uvkokpu.zip",
      "zip_entry": "wp_uvkokpu/wp_uvkokpu.php",
      "declared_php_bytes": 19741,
      "request_body_bytes": 11369,
      "request_body_sha256": "2f28e403d75c05a6c7784aa971b489cd9c0358617d8707d11ee0fe7c6da04309",
      "subsequent_exact_path_gets": 5,
      "followup_delays_seconds": [
        1.536,
        2.877,
        4.071,
        5.16,
        6.761
      ],
      "followup_observation_end_utc": "2026-08-11T22:24:12.868Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-08-27T00:17:33.209Z",
      "src_ip": "198.98.53.213",
      "asn": 53667,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_prakykx.zip",
      "zip_entry": "wp_prakykx/wp_prakykx.php",
      "declared_php_bytes": 19741,
      "request_body_bytes": 11397,
      "request_body_sha256": "dddb06562b2f6d1fd82c882fe281573e67b84145bf2b4e988d2fb2fb200c8a9a",
      "subsequent_exact_path_gets": 5,
      "followup_delays_seconds": [
        1.976,
        2.908,
        3.801,
        4.783,
        7.998
      ],
      "followup_observation_end_utc": "2026-08-28T00:17:33.209Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-08-30T11:31:42.590Z",
      "src_ip": "45.61.185.216",
      "asn": 53667,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_qldsigj.zip",
      "zip_entry": "wp_qldsigj/wp_qldsigj.php",
      "declared_php_bytes": 19741,
      "request_body_bytes": 11385,
      "request_body_sha256": "d5bee1ae59430f2065c36a11ba25cc4af9b30d996903d805332ccd561488f14a",
      "subsequent_exact_path_gets": 5,
      "followup_delays_seconds": [
        3.739,
        13.069,
        14.251,
        15.231,
        16.125
      ],
      "followup_observation_end_utc": "2026-08-31T11:31:42.590Z",
      "evidence_extent": "decrypted_body_preview_and_zip_local_header_only"
    },
    {
      "timestamp_utc": "2026-09-06T14:10:43.761Z",
      "src_ip": "193.148.57.33",
      "asn": 209946,
      "command": "plugin.upload_plugin",
      "zip_filename": "wp_zmfjlow.zip",
      "zip_entry": "wp_zmfjlow/wp_zmfjlow.php",
      "declared_php_bytes": 3686,
      "request_body_bytes": 4087,
      "request_body_sha256": "3b321d1d5568f32b0049682e935a4f6807096985e4aa857ec65cdde5fcf243a4",
      "subsequent_exact_path_gets": 0,
      "followup_delays_seconds": [],
      "followup_observation_end_utc": "2026-09-06T16:20:00.000Z",
      "evidence_extent": "complete_raw_body_zip_and_php_verified"
    }
  ]
}