Hacked before the patch

One of my own Joomla websites was hacked through a critical security vulnerability in YOOtheme Pro, more than six hours before the security update was available. I updated YOOtheme Pro just 10 minutes after the patch was released, but the attackers were already inside.

By analysing the server logs and PHP webshells, I could reconstruct the attack step by step. I discovered that at least three different hacker groups had gained access to the website. They placed around 15 backdoors, created more than 5,600 .htaccess files and used the website to show Japanese spam pages to Google, while normal visitors still saw the original website.

In my blog, I explain how the attackers got access, what they did, how I investigated the hack and how I restored the website using a clean backup.

And most importantly, I share what I learned from this attack, which extra security measures can protect your Joomla website, and why keeping everything updated is important, but sometimes simply not enough.