Attackers are compromising websites at scale and installing hidden tools on servers to maintain remote control. The campaign has hit numerous small and medium-sized organizations in Australia. However, the attacks extend well beyond any single country. Australia's Cyber Security Centre has issued a public advisory on the CMS exploitation campaign. It warns that attackers are automatically scanning websites for vulnerable CMS platforms and plugins.