WordPress Backdoor Uses Multiple Persistence Mechanisms to Self-Rebuild After Cleanup

Sophisticated WordPress Backdoor Discovered

Cybersecurity researchers have uncovered a WordPress compromise featuring a backdoor, codenamed SC, that utilizes multiple persistence mechanisms. This design ensures the payload continuously reappears, even after administrators attempt to clean the infected site. The malware has been described as a "self-healing mesh" by Sucuri.

Multi-Point Persistence Strategy

The SC backdoor maintains its presence through at least eight different locations, including various files, the WordPress database, and shared memory segments. This distributed approach means that if one part of the backdoor is removed, another can restore it, creating a resilient infection that is challenging to eradicate. The system lacks a single point of failure that can be targeted for removal.

Obfuscation Techniques Employed

The malware employs obfuscation techniques, including a decoder that uses a substitution cipher to unscramble its code. This makes analysis and detection more difficult for security professionals. The absence of readable function names further complicates efforts to understand and neutralize the threat.

Key Components of the Backdoor

The eight identified components include .user.ini for auto-prepending a loader, wp-content/c1b12371.php as a loader, and wp-content/.c1b12371.php as a first-stage loader. Other critical parts are wp-content/db.php and wp-content/advanced-cache.php, which carry and redeploy the payload from multiple sources. A theme-resident twin, wp-content/themes/khorshidi/functions.php, also exists, alongside the actual malware installed as a must-use plugin and normal plugin, wp-content/mu-plugins/hyper-engine-kit.php and wp-content/plugins/hyper-engine-.