The FBI is advising people responsible for WordPress websites to be on the lookout for attacks carried out by individuals sympathetic to the Islamic State of Iraq and al-Shams terrorist group, which is also known as the Islamic State in the Levant. The mostly unskilled attackers are exploiting known vulnerabilities that have already been patched by developers of the widely used content management system and widely used plugins—but individual Web masters have failed to install them.

"Successful exploitation of the vulnerabilities could result in an attacker gaining unauthorized access, bypassing security restrictions, injecting scripts, and stealing cookies from computer systems or network servers," a public service announcement the FBI published Tuesday warned. "An attacker could install malicious software; manipulate data; or create new accounts with full user privileges for future Web site exploitation."

The FBI assesses that the perpetrators are not members of the ISIL terrorist organization. These individuals are hackers using relatively unsophisticated methods to exploit technical vulnerabilities and are utilizing the ISIL name to gain more notoriety than the underlying attack would have otherwise garnered. Methods being utilized by hackers for the defacements indicate that individual Web sites are not being directly targeted by name or business type. All victims of the defacements share common WordPress plug-in vulnerabilities easily exploited by commonly available hacking tools.

The steady stream of vulnerabilities found in WordPress plugins, and to a lesser extent WordPress itself, make defacements and other types of website compromises largely a cut-and-paste exercise. Earlier Tuesday one such vulnerability came to light in a WordPress plugin with one million active installations . Relatively unskilled miscreants are seizing on sites that fall behind applying patches. The PSA went on to say:

Tuesday's FBI advisory was one of two to recently warn of website hacks carried out on behalf of extremist causes. According to a post published Tuesday by KrebsOnSecurity, a separate alert the FBI issued to private companies warned that several groups may participate in "OpIsrael," an operation that will target Israeli and Jewish websites to coincide with Holocaust Remembrance Day (April 15 and 16). The actors are usually located in the Middle East and North Africa and routinely conduct pro-extremist, anti-Israeli, and anti-Western cyber operations, the advisory quoted by reporter Brian Krebs stated.

A separate PSA the FBI issued Tuesday advised people to be wary of fake government websites that steal both money and personal information. The criminal-operated sites often appear at the top of search results and masquerade as an official government service that processes requests in exchange for a fee. The advisory continued:

Once the forms are completed and submitted, the fraudulent website usually requires a fee to complete the service requested. The fees typically range from $29 to $199 based on the government service requested. Once the fees are paid the victim is notified they need to send their birth certificate, driver’s license, employee badge, or other personal items to a specified address. The victim is then told to wait a few days to several weeks for processing. By the time the victim realizes it is a scam, they may have had extra charges billed to their credit/debit card, had a third-party designee added to their EIN card, and never received the service(s) or documents requested. Additionally, all of their PII data has been compromised by the criminals running the websites and can be used for any number of illicit purposes. The potential harm gets worse for those who send their birth certificate or other government-issued identification to the perpetrator.

The PSA advises people to verify a site is connected to a given government agency by checking WHOIS records and searching for negative reviews.