Researchers from Sucuri have dissected a persistent WordPress infection known as SC malware that restores any deleted backdoor components within seconds. The malware achieves this resilience through a minimum of eight interconnected persistence points distributed across multiple layers of the site.
The infection conceals itself in PHP configuration directives, hidden loaders, theme files, and plugins. Several components activate before regular WordPress plugins, rendering standard admin-panel cleanup ineffective and turning remediation into a repetitive loop.
Copies of the malicious code are additionally stored in the site database and, on servers supporting the feature, in System V shared memory. Removing files from disk can therefore be immediately reversed by the next request that pulls the payload from an untouched source.
The backdoor itself remains hidden from the plugin list, collects information about the site and administrator sessions, installs further PHP code, and disables protective plugins. Injected JavaScript is capable of harvesting payment data from e-commerce sites.
Commands are received via public Ethereum RPC gateways and smart contracts, with multiple alternative channels ensuring continued operation even if one address is blocked.
A notable cleanup hazard exists because PHP caches the directive that launches the malicious loader. Deleting the referenced file without first stopping execution can break PHP request handling entirely.
Sucuri advises first halting the malware, then removing database and memory copies along with malicious scheduled tasks and hidden accounts, before finally cleaning files and rotating compromised credentials.
