Russian SoakSoak Malware Threatens More Than 100,000 WordPress Sites

Is your WordPress theme leaving you susceptible to vicious malware? Russian Malware "SoakSoak,” has infected more than 100,000 WordPress sites to date, and your site could be at risk.

SoakSoak has been embedded in the plugin: Slider Revolution, which came bundled with a number of older WordPress themes. If you’ve downloaded that plugin, or if you have an older theme installed, your WordPress site may be at risk. According to Gizmodo, "Google has already blocked 11,000 domains to try to curb the damage.”

Read on to discover more about SoakSoak, and how you can protect your WordPress site.

What is SoakSoak?

The Russian Malware, SoakSoak, loads an attack code onto the WordPress site. Like all malware, the code is designed to damage and/or disable computers and computer systems. In this case, the code intends to damage and disable WordPress sites. It’s yet unknown what the hackers plan to do with the information they collect, but it can be assumed that any stolen data will be used maliciously.

Who is At-Risk for Infection?

If you’re using an older theme, you’ll want to determine if Slider Revolution came packaged with your theme. If so, remove it immediately, and then contact WordPress (or your hosting company, such as BlueHost or GoDaddy). Let them know you think you may have been infected with the virus, and see if they can’t advise on the best course of action.

If you’re concerned you may be infected, but can’t determine whether or not you’re using (or, have used) a RevSlider plugin, you can use the Sucuri Website Security Scan to sitecheck your website. This service is free, and it only take a moment to determine if your site is infected or not.  

It’s important that the issue is fixed – preferably, before Google blocks your domain. Gizmodo has reported that only self-hosted sites seem to be affected, and that personal blogs are okay.

How to Protect a WordPress Site against SoakSoak and Other Vicious Malwares

Removing the plugin is a great first step. Unfortunately, the plugin’s designers have yet to create an update that will remove any potential threat. This could mean uninstalling an entire theme, and installing a new theme.

After deletion, more steps are needed to absolutely conclude the threat has been contained. For instance, it’s essential to install a website firewall. Malicious attacks cannot break through the firewall, and thus there can be no fear that an attack has occurred. Also, it’s essential to spread the word about the virus, as this will help ensure everyone is working diligently to remove the threat together.

Finally, it’s absolutely necessary to have up-to-date virus protection. According to Trend Micro, the best antivirus for Mac and Windows computers should feature malware defenses, phishing defenses, fast web protection, identity theft guards, privacy protection (including social media), and safe surfing. 

What’s WordPress Doing to Fix This?

According to Entrepreneur.com, WordPress issued this information in a statement:

"Automattic [WordPress.com’s parent company] is taking action to protect sites from the vulnerability. VaultPress, a backup and security product, has included protection from this vulnerability since it was first announced back in September.”

That’s good news for newer WordPress users, but for those of you who are using an older theme, it’s essential that you get your site checked out. If you determine your site is in good health, you may still want to remove the RevSlider plugin – at least until an update is completed that removes the threat.