JusticeDept.com

Last Wednesday, we began noticing unusually high incoming traffic across our servers. We determined that this traffic was caused by an automated program that was attempting to break in to our customers’ WordPress sites. This also had the effect of slowing down our Linux servers due to all of the extra traffic.

This attack is not limited to our network, but targets WordPress users worldwide, across many hosting companies.

We began blocking all attempted connections to the wp-login.php file. This block stopped the malicious connections from breaking in, but unfortunately, it also stopped legitimate users from logging in as well. This was a temporary, but necessary solution as we continued to work on a remedy for this situation.

We have now rolled out a new fix which blocks the malicious connections, but allows users to access their wp-login file. This means that if you have a WordPress site, you should now be able to login and make changes. However, once you log in, we recommend that you change your password to something very strong (e.g. a mixture of upper and lowercase letters, numbers, and special characters like #, $, and &). You can find instructions on how to change your password here: http://codex.wordpress.org/Resetting_Your_Password.

We are still keeping a close and active eye on this attack, as it seems to be very dynamic and will attempt to change its approach to counter our defenses. So, you may notice some quirks and fluctuations with your WordPress site until we’ve either completely blocked the attack, or the attack stops altogether.