OTX Threat: How WP-SHELLSTORM Exposed 1.4M WordPress Sites

A financially motivated cybercrime group operating as WP-SHELLSTORM was exposed when their Python SimpleHTTPServer remained open for 22 days, revealing toolkits, logs, and target lists. The operation targeted over 1.4 million domains using 27 weaponized CVEs and deployed more than 5,700 active webshells across WordPress and Joomla platforms. A parallel campaign targeted Apache Nacos, XXL-Job, and CVEs: CVE-2020-25213, CVE-2021-29441, CVE-2026-1969, CVE-2026-0740, CVE-2026-3844 Sectors: Finance,