GoDaddy is the world's largest domain registrar and one of the largest web hosting providers, with over 20 million customers and 82 million domain names under management. Between 2019 and 2023, the company disclosed three significant security incidents affecting its WordPress hosting infrastructure. In December 2022, when disclosing the third incident, GoDaddy revealed something remarkable: it believed all three incidents were connected - parts of a multi-year campaign by a sophisticated threat actor with a long-term strategy to compromise GoDaddy's infrastructure.

The attacker's apparent goal was not to steal customer credentials or payment card data in the conventional sense. The evidence suggested they wanted to install malware on GoDaddy's managed WordPress hosting servers to redirect customer websites to malicious destinations. A hosting provider serving millions of websites is an extraordinarily valuable position for a threat actor interested in drive-by download attacks, phishing infrastructure, or SEO manipulation - gaining access to GoDaddy's hosting infrastructure meant potentially weaponizing millions of legitimate websites with established search engine rankings and visitor trust.

Three Incidents, One Campaign

The first incident (disclosed May 2020, occurred October-November 2019): a GoDaddy employee's credentials were used to access approximately 28,000 customer hosting accounts. The attacker used SSH to access those accounts, potentially modifying hosted files. GoDaddy said it detected "unusual activity" and notified affected customers.

The second incident (disclosed November 2021): the attacker used a compromised password to access GoDaddy's managed WordPress hosting environment. Approximately 1.2 million active and inactive managed WordPress customers had their email addresses and customer numbers exposed. WordPress admin passwords, sFTP credentials, and SSL private keys were compromised. This was a substantially more serious incident - sFTP and WordPress admin credentials would allow the attacker to directly modify any affected website's content.

The third incident (disclosed December 2022): GoDaddy discovered that an attacker had installed malware on its cPanel shared hosting servers and obtained source code "related to some services within GoDaddy." The malware was used to redirect customer websites intermittently to malicious domains. Customers had been reporting anomalous website redirects for several years without a satisfactory explanation; this disclosure explained them.

[TECHNICAL NOTE]
The malware-on-hosting-servers attack described in GoDaddy's 2022 disclosure is particularly notable from a technical and business model perspective. Managed WordPress hosting on a shared infrastructure model means thousands of customer websites run on the same underlying server infrastructure. Malware installed at the server level - below the WordPress application layer - can affect all customers hosted on that server without needing to compromise each customer's WordPress installation individually. The reported behavior - intermittent redirects of hosted websites to malicious domains - is consistent with malware that modifies HTTP responses or DNS responses at the server level, inserting redirect headers or responses into traffic flowing through the server. This type of attack is valuable for: pharma/casino SEO spam campaigns (redirecting legitimate site traffic to spam pages); drive-by download campaigns (delivering malware to visitors of legitimate sites); phishing infrastructure (using legitimate domain reputation to avoid blacklisting). The attackers' preference for malware-on-hosting-infrastructure over credential theft suggests their goal was sustained, covert capability to redirect legitimate web traffic rather than immediate financial gain from stolen credentials.

Attribution and the "Sophisticated Threat Actor" Claim

GoDaddy's December 2022 disclosure stated: "Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy." This was an unusual disclosure. Most breach disclosures describe a specific, bounded incident. GoDaddy was describing a multi-year persistent compromise.

The company did not name the threat actor or describe the attribution methodology. The reference to "sophisticated threat actor" and the strategic goal of hosting infrastructure compromise - rather than credential monetization - pointed toward either a financially motivated group with a specific spam/redirect business model (common in the SEO spam and gray-hat advertising ecosystem) or a state actor interested in website redirect infrastructure for intelligence or influence operations. Security researchers and journalists who analyzed the incidents leaned toward the former: the redirect behavior was consistent with affiliate marketing fraud and ad injection campaigns run by organized criminal groups, not nation-state espionage patterns.

GoDaddy coordinated with multiple intelligence agencies and other web hosting companies who had experienced similar incidents, suggesting the campaign was not unique to GoDaddy. The attacker appeared to have a playbook for compromising large hosting providers.

[WARNING]
The GoDaddy breaches illustrate a specific risk model for companies that host content for others: hosting infrastructure is a force multiplier for attackers. Compromising one hosting provider affects millions of downstream websites. The blast radius is not the hosting provider's data but the hosted customers' data and their visitors' security. Millions of small businesses, nonprofits, and individuals trust hosting providers to protect not just their credentials but the integrity of their websites - websites that their customers and users trust. The redirect malware installed on GoDaddy's servers could have exposed millions of website visitors to malicious content without those visitors' knowledge and without the website owners knowing their sites had been weaponized. The four-year span of the campaign (2019-2023) without full detection suggests that the malware was installed in a way that evaded GoDaddy's server monitoring. Managed hosting providers at scale run thousands of servers; comprehensive file integrity monitoring and behavioral detection across the entire hosting fleet is a significant operational challenge that many providers may not fully address.

WordPress Hosting Security Implications

The GoDaddy incidents highlighted security challenges specific to WordPress hosting at scale. WordPress is the world's most popular content management system, powering approximately 43% of all websites. Its ubiquity and plugin ecosystem make it a frequent target for attacks ranging from brute force of admin credentials to plugin vulnerability exploitation. Managed WordPress hosts like GoDaddy attempt to simplify WordPress management by handling updates and security configuration - but this centralization means a compromise of the host's management layer affects all hosted sites.

The sFTP credential exposure in the 2021 incident was particularly damaging. sFTP provides direct file system access to a website - equivalent to having local write access to all website files. An attacker with sFTP credentials can inject malicious code into WordPress theme files, add backdoor PHP scripts, or modify any website content without needing to exploit WordPress itself. The exposure of 1.2 million sFTP credential sets gave the attacker the ability to directly modify the websites of 1.2 million GoDaddy managed WordPress customers.

GoDaddy's post-breach remediation included mandatory password resets for affected customers, the provisioning of new SSL certificates for those whose certificates had been exposed, and enhanced monitoring and security tooling across its hosting infrastructure. The company also invested in additional security staff and engaged external security firms for ongoing monitoring.

[IOC]
GoDaddy breach timeline summary: Incident 1 - occurred October-November 2019, disclosed May 4, 2020; scope: approximately 28,000 customer SSH hosting accounts accessed; attacker used compromised GoDaddy employee credentials. Incident 2 - occurred September 6, 2021, discovered November 17, 2021, disclosed November 22, 2021; scope: 1.2 million managed WordPress customers; exposed data: email addresses, customer numbers, WordPress admin passwords (reset by GoDaddy), sFTP credentials, database credentials, SSL private keys for subset of active customers. Initial access: compromised password in GoDaddy's provisioning system for Managed WordPress. Incident 3 - duration unclear, discovered December 2022, disclosed December 2022; scope: cPanel shared hosting servers; malware installed for intermittent website redirects; source code theft. GoDaddy attribution assessment: multi-year campaign by "sophisticated threat actor group." No public law enforcement attribution. Indicators observed by affected customers: intermittent website redirects to unfamiliar domains; unexpected file changes in web root; unfamiliar PHP files in theme directories. Customer actions recommended: change WordPress admin password; rotate sFTP/FTP and database credentials; review hosted files for unexpected additions; regenerate SSL certificates; install file integrity monitoring plugin (Wordfence, Sucuri).