Beware Russians Bearing Outdated Ukrainian Software

I have been testing Wordfence as my primary security for WordPress sites, and I have been getting more positive about it as I go along. I will almost certainly use the free version on my more minor sites and probably the Pro version on a couple of major ones. In any case, what they do is security. They study Malware and defend against it, and I have thus far found them competent at that task.

They analyzed the released government data on Russian hacking. One should remain aware that it is unlikely that the government released all data in their possession, but one would assume they would release data that points clearly to the culprits. But we should be aware that any conclusion is based on a subset of the data.

Here is the conclusion of the rather lengthy (and interesting) article on the Wordfence blog:

The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes.

The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website.

Hmmm.