Someone stole my client's website. Wtf?

[herps]

This is SO weird. I don't even know where to post this so hopefully lounge is cool?

Someone stole my client's website and made an exact copy. It's a small website. The design is OK, but nothing worth stealing. Same graphics, same theme, same plugins installed, etc. Even their theme has the same directory name as our custom theme. It's really freaking strange. We thought maybe they were going to spoof us and phish client data, but it's seeming unlikely. Now I know what you're going to say: They didn't steal anything. They just hired a fiverr dev and they copied the design verbatim. No, that's not true. Our admin got email notifications from their new website saying that they logged in. They stole our database too.

After some time, we noticed that the dev was updating and manipulating the website to make something completely different. Like they had started with our website and are now making a whole different website. Why??? What kind of weird scam is this? Does anyone know what this could be about? Has anyone experienced this?

I've been doing this for over 2 decades and I've seen exploits, malware, backdoors, etc, but this is the first time I've seen someone break into a website, copy it, and use it to build another website. Seems like a lot of work for stealing a template to resell.

 

[slippery_slider]

Next time, secure your server.

 

[tidelow]

First order of business is eliminating any possibility it was done from someone within the company.

If there are no salty employees, contractors, tech support teams that have had admin access, then you can safely assume you have a breach issue.

Then you need to identify the time/date you were breached, this can be in form of hen malicious scripts, new files inside your (assuming WP) website, new admin user ?

Once you have the time frame, you can identify the culprit wordpress plugin that may have been exploited, and check server logs.

There are many ways to target a website, do you have backup files in the wp-content?

 

[tidelow]

Check all email accounts associated with WP admin thru here:

https://haveibeenpwned.com/

Do you use a common password for your account logins on other sites?

 

[Monzani]

yoursite.com/wp-admin

username: admin
password: admin

I hope that did not happen

 

[joker_darkie]

2022

 

[herps]

I'm not asking about opsec. That's not even my department. Yes, the client failed in that area. I've been picking up the pieces there. I believe the biggest problem is that they're using a host from 1995 and it's not even GoDaddy. My guess is they used something really stupid like a directory traversal attack if not another really easy to find exploit. Tbh, there are old copies of this website in easy to guess filenames like http://websitename.com/website-backup-old123/backup.zip with database and all. There's many ways they could have gotten in and tbh I don't really care about that.

What I'd like to know is...why? Most plausible answer in this thread so far has been "inside job" but I don't think anyone at this company is even competent enough to get into FTP. They're not even using this website to spoof/phish. It looks like they're repurposing the website for their own client which is in a completely different industry. Also, the IP that Wordfence reports to us is from Russia. Big surprise. I'm hoping someone knows if this is a common scam or not.

 

[herps]

Check all email accounts associated with WP admin thru here:

https://haveibeenpwned.com/

Do you use a common password for your account logins on other sites?

Great idea. Thank you! My accounts all use a password manager. I wouldn't put it past the other admins to use something short and plaintext.