Following up on an excellent blog post we discovered (linked in thread), we dug a little deeper on a recent plugin compromise. We have more IoCs for you, and what we believe to be a use of the blockchain for an initial access auction for the plugin install base.

https://discourse.ifin.network/t/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/265/8