WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Cybersecurity researchers have discovered a WordPress compromise where attackers used multiple methods to maintain access to the site. The backdoor, codenamed SC, uses various persistence mechanisms to rebuild itself after being cleaned up. These mechanisms involve files, database, and shared memory, allowing the final payload to return without requiring reinfection. The malware has been described as a self-healing mesh by Sucuri. This complex setup enables the backdoor to persist on the compromised site. The SC backdoor is characterized by "SC_" markers in the injected content.