ATTENTION! The deleted malicious software on WordPress sites is being restored in a few seconds!

A malicious program named SC possesses the ability to restore deleted malicious files on WordPress sites by utilizing multiple persistence mechanisms across various system locations. The program achieves this restoration through a chain reaction where deleting one component triggers another to recreate it, leading to full restoration. Attackers utilize several hidden locations for components, including site files, the database, server memory, and specific plugin directories like wp-content/plugins and wp-content/mu-plugins. A critical mechanism involves modifying the .user.ini file with an autoprependfile directive, which allows malicious code to execute before WordPress initialization, potentially bypassing standard detection methods. Furthermore, the program stores full copies of its code in the database, shared memory, and dynamically recreates files within theme functions to ensure persistence even after individual deletions. The threat extends beyond simple file removal to include hiding itself from administrative views and targeting administrator sessions, utilizing blockchain infrastructure for command and control communication.

The narrative highlights that modern persistence mechanisms often rely on systemic entanglement rather than single points of failure, challenging the conventional security paradigm centered on file deletion. The SC program exemplifies a shift from static malware infections to dynamic, adaptive systems where system states themselves become vectors for attack and recovery. The core implication is that defensive strategies focused narrowly on file system scanning fail when the underlying operational context—including database structures, memory states, and execution flows (like PHP pre-loading)—is compromised. The complexity introduced by using shared memory and blockchain channels to command reinforces a systemic view of compromise, suggesting that security must be holistic rather than localized to specific directories. This structure suggests an attacker prioritizing resilience against known remediation tactics, aiming for recovery success regardless of intermediate cleanup efforts. What is being obscured is the reliance on interconnectedness as a feature, not a bug, in system design. How does this dependence on layered persistence affect trust models when administrators operate under the assumption that deleting a file resolves the threat?