The WPSetup Attack: New Campaign Targets Fresh WordPress Installs

At Wordfence, we track millions of attacks from a wide variety of sources every day. From this data we create a list of the worst-of-the-worst attackers and add those to our IP blacklist to protect our Premium customers. We also carefully monitor the activity that those known bad IP addresses engage in. In May and June, we saw our worst-of-the-worst IPs start using a new kind of attack targeting fresh WordPress installations. We also had our first site cleaning customer that was hit by this attack.
Attackers scan for the following URL:
/wp-admin/setup-config.php
This is the setup URL that new installations of WordPress use. If the attacker finds that URL and it contains a setup page, it indicates that someone has recently installed WordPress on their server but has not yet configured it. At this point, it is very easy for an attacker to take over not just the new WordPress website, but the entire hosting account and all other websites on that hosting account.
The graph below shows the campaign we tracked and the number of scans per day for /wp-admin/setup-config.php that we saw from several known bad IPs:
How the WPSetup Attack Works
There are several ways you can install WordPress.
Source: https://managewp.org/articles/15685/the-wpsetup-attack-new-campaign-targets-fresh-wordpress-installs

source https://williechiu40.wordpress.com/2017/07/19/the-wpsetup-attack-new-campaign-targets-fresh-wordpress-installs-2/