---
title: Hunt: UpdraftCentral backdoor pushes — 'WordPress/6.4; class-udrpc.php' POSTs, 'keeps option storage tidy' plugins, @example.org 'Site Tools' editors | ctxsec
url: https://ctxsec.com/items/hunt-updraftcentral-backdoor-plugins
description: ""
status: "hunt idea (Nethemba / Patchstack IOCs)"
published: 2026-10-19
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-updraftcentral-backdoor-plugins.md)

hunt idea (Nethemba / Patchstack IOCs)

2026-10-19

### Hunt: UpdraftCentral backdoor pushes — 'WordPress/6.4; class-udrpc.php' POSTs, 'keeps option storage tidy' plugins, @example.org 'Site Tools' editors

Across WordPress fleets and hosting logs:

1. **Access logs:** `POST /` with User-Agent exactly `WordPress/6.4; class-udrpc.php`. Real UpdraftCentral Cloud traffic sends `class-udrpc.php/2.0; https://teamupdraft.com`. Source IPs `43.250.53[.]42` and `2a09:bac5:4e21:2e3c::49b:9`, but Patchstack says the attacker rotated infrastructure, so don't rely on IPs alone. Nethemba's grep: `grep 'class-udrpc.php"' access.log`.
2. **Backdoor triggers:** GET requests with a parameter of `_` plus 6 hex characters, or 12 hex characters, carrying a 32-character value, followed by a 302 to wp-admin (`zgrep -E '[?&](_[0-9a-f]{6}|[0-9a-f]{12})=[^&" ]{32}[& ]'`).
3. **UpdraftCentral client log** (option `updraftcentral_client_log`, last 50 events only): `probe.central.updraftplus.com`, then `Command received: plugin.upload_plugin` or `plugin.delete_plugin`.
4. **Files:** plugins with the description "Small maintenance toolkit: keeps option storage tidy." or names like `load-stack-35c`, `text-gantry-eb0`, `style-bridge-8f5`, `media-kit-183`, `boost-kit`, `cache-smith`, `site-health-364f`, or "Site Health Cache" (the most reused name per Patchstack). Also check `wp-content/upgrade/`, where pushed plugins stay even if the install failed. Main-file SHA-256s are in Nethemba's IOC table, for example `3c3355f7…209f` and `bb40f9a8…0801`.
5. **Database:** options matching `*_sync_token`, `*_uid`, `*_installed`, or `site_health_364f_ver`. Look for users with `@example.org` or `@example.com` emails, display names "Site Tools", "System Team" or "Web Tech", or Editors holding `manage_options` or `install_plugins`.

Nethemba publishes a read-only check script (run with `wp eval-file check-updraftcentral.php --skip-plugins --skip-themes`). Don't "fix" a crashing backdoor; one variant fails only because of a coding bug.

Sources: [Nethemba IOCs + script](https://nethemba.com/updraftcentral-backdoor-analysis/) · [Patchstack](https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/)