Actor Profile

StopAndProtect is a global cybercrime operation tracked by Check Point Research since mid-May 2026. The operation is named after a ransomware family discovered during initial investigation. Rather than focusing on a single malware variant, the actor employs a comprehensive toolkit of criminal software components working in concert. The operation's motivation appears financially driven, with capabilities spanning ransomware deployment, credential theft, and covert data exfiltration. Operational security failures exposed infection logs, victim screenshots, and mass-management tools, revealing the actor may have inadvertently infected their own development environment. The operation demonstrates sophisticated infrastructure abuse, leveraging nearly 2,000 compromised WordPress sites for malware hosting, command-and-control, and stolen data storage.

TTPs (Tactics, Techniques, Procedures)

Initial access via ClickFix social engineering (T1204.001 - User Execution: Malicious Link) delivering PowerShell commands (T1059.001). Multi-stage .NET downloader chain with sandbox evasion (T1497). Main payload components include: SilentEncryptor ransomware (T1486), NetworkShareScanner SMB/USB worm (T1080 - Taint Shared Content), VBS spreader for lateral movement via WMI (T1021.006), LockScreen utility (T1486), SimpleChatProxy for C2 communication (T1071), and SilentDataCollector credential stealer (T1005, T1113 - Screen Capture, T1056.001 - Keylogging). Data exfiltration (T1041) includes WhatsApp automation for targeted collection. Persistence via WordPress must-use plugins (T1505.003 - Web Shell). Compromised WordPress sites serve as C2 infrastructure (T1584.004 - Compromise Infrastructure: Server). Custom PHP uploader enables arbitrary file upload and remote code execution (T1505.003).

Targets & Patterns

Primary targets are technology and web hosting sectors, with victims identified across global geography. As of July 24, 2026, over 6,000 unique IP addresses were compromised, with highest concentrations in the United States (1,852), Russia (630), and India (630). The operation exploits outdated WordPress installations and vulnerable plugins—one compromised site ran WordPress from 2021 with approximately 40 known vulnerabilities. Targeting pattern suggests opportunistic exploitation of poorly maintained web infrastructure rather than strategic sector selection. Visitors to compromised sites are indiscriminately targeted through fake CAPTCHA overlays. The actor's infrastructure abuse model prioritizes sites with weak security posture, enabling mass compromise for botnet operations supporting both ransomware and silent data theft campaigns.

Historical Context

StopAndProtect was first identified by Check Point Research in mid-May 2026 following discovery of the namesake ransomware family. The campaign has been continuously active from mid-May through at least July 2026, with over 700 stolen data archives identified during this period. The operation represents an evolution in cybercrime tactics, moving away from single-malware campaigns toward modular toolkit approaches. The actor's OPSEC failures—including exposure of infection logs, victim screenshots, and management tools—provided unprecedented visibility into campaign infrastructure and methodology. Evidence suggests the operator inadvertently infected their own development environment, with internal development files and tools appearing among exfiltrated data. No direct links to previously known cybercrime operations or APT groups have been established in available reporting.

Defensive Recommendations

  • Monitor for ClickFix-style social engineering delivering PowerShell commands (T1059.001); detect via Sysmon Event ID 1 and PowerShell script block logging (Event ID 4104)
  • Implement WordPress hardening: enforce automatic updates, audit and remove outdated plugins, deploy web application firewalls to detect malicious plugin installation and arbitrary file uploads
  • Detect must-use (MU) plugin creation in wp-content/mu-plugins directory through file integrity monitoring; alert on unexpected PHP file uploads outside normal administrative workflows
  • Monitor for SMB lateral movement (T1021.002) and WMI execution (T1047) indicative of NetworkShareScanner and VBS spreader activity; baseline normal network share access patterns
  • Deploy endpoint detection for SilentDataCollector behaviors: keylogging (T1056.001), 30-second screenshot intervals (T1113), WhatsApp automation, and encrypted data staging prior to exfiltration (T1560.001)