Mr_Rot13 is a threat actor targeting WordPress with PHP backdoors and covert C2 communication over Telegram.
Analyst brief
Mr_Rot13 is a clustered threat actor active since 2020, employing the Rot13 algorithm for code obfuscation. They primarily target WordPress platforms, exploiting CVE-2026-41940 to deliver malicious payloads via a PHP backdoor. Their key TTPs include covert C2 communication over Telegram and maintaining a low detection rate through advanced operational security. Defenders should focus on patching WordPress installations, monitoring for suspicious PHP file writes, and inspecting anomalous network traffic to Telegram.
Mr_Rot13
unknown
Mr_Rot13 is a stable hacking group identified through a PHP backdoor and a Downloader domain linked to a C2 infrastructure active since 2020. They utilize the Rot13 algorithm for obfuscation and have demonstrated a low detection rate across security products, indicating advanced operational security. Their activities include exploiting CVE-2026-41940 to deliver malicious payloads and maintaining covert communication via Telegram. The group has shown a particular focus on WordPress as a target, with ongoing operations that suggest a sophisticated threat actor rather than opportunistic attackers.