On this page (7 sections)

Sucuri has described a WordPress malware family it calls SC, after the "SC_" markers it found in injected content. During a cleanup, the same backdoor reappeared within seconds of each removal, because copies of it sit in at least eight places and any of them can restore the rest. (Sucuri)

If you run WordPress sites, or clean them for clients, this matters because deleting the obvious bad file may achieve nothing, and a careless deletion can even take a site offline. Only one publisher covers this so far, and the part of the Sucuri article we could read is incomplete, so some details below are marked as unconfirmed.

What happened

Sucuri's analysts were cleaning a compromised WordPress site when they noticed that deleted files kept coming back almost instantly. The cause was a circular design. Removing the plugin lets a drop-in write it again. Removing the drop-in lets the theme restore it. Wiping every file on disk is not enough either, because the next page load can rebuild the set from the database or from a shared-memory segment. Sucuri's conclusion is that there is no single piece you can remove to end the infection.

Sucuri adds that every file it examined uses the same obfuscation approach. There is no eval call, the newest pieces carry no marker, and function names are unreadable. Each file holds a table of scrambled strings plus a small decoder that maps a numeric index to a real function name, which makes simple string searches unreliable.

How the infection is built

Sucuri describes eight components. The first six trigger, load or rebuild the malware, and the last two are the backdoor itself.

The eight SC components, summarized from Sucuri's analysis
LocationWhat it does
auto_prepend_file line in .user.iniMakes PHP run a loader ahead of every request in that directory tree, including requests that never reach WordPress.
Plainly named PHP shimIncludes a hidden dot-prefixed file when one sits beside it. If a defender deletes only the hidden file, the shim quietly does nothing and the site keeps working while another part recreates it.
Hidden dot-prefixed loaderRebuilds the fake plugin inside mu-plugins, trying an existing plugin copy, an encoded stub in the cache directory, then a ZIP bundle with a random hex name. It calls opcache_invalidate so the new file runs at once.
wp-content/db.phpA drop-in that holds the full payload as a gzip plus base64 blob and rewrites the plugin if it is missing or too small.
wp-content/advanced-cache.phpA drop-in loaded before regular plugins when caching is on. It searches five sources in order: a mu-plugin, a plugin copy, a System V shared-memory segment, ZIP bundles in several folders, and the database.
End of the active theme's functions.phpA block fenced by begin and end markers that restores the plugin whenever it disappears.
Backdoor as a must-use pluginA large WordPress-aware file that loads automatically and invisibly.
Backdoor as a normal pluginAn identical copy with a fake settings page, a shortcode and an activation hook, so it resembles a real caching plugin.

For the database route, Sucuri says advanced-cache.php connects directly using the site's own credential constants and reads the payload from a particular option row. It also says the two payload copies keep each other updated so both stay on the same version.

Why the .user.ini detail can cause an outage

PHP caches the auto_prepend_file value. Sucuri warns that if the target file is deleted while that cache is still warm, every PHP request on the account fails until the cache expires. A rushed cleanup can therefore turn a reinfection problem into downtime.

What is not confirmed

Sucuri's headline mentions a blockchain-controlled backdoor and the article promises a cleanup order of operations. The excerpt available to us does not cover what the backdoor does, how blockchain is involved, how sites were first compromised, how many are affected, or Sucuri's recommended sequence. We are not guessing at those points. The full Sucuri write-up is the place to read them.

Who is realistically exposed

Because the entry point is not stated, we cannot blame a particular plugin, theme or host. What we can say is where SC hides: dot-prefixed files, drop-ins in wp-content, the mu-plugins folder, the bottom of the active theme's functions.php, and a .user.ini prepend line. Few owners review those places regularly.

The likeliest candidates are sites that were cleaned yet show the same symptoms again, or where deleted files reappear within seconds. If that sounds familiar, run the checks below.

How to check your site

These checks only read data. Run them over SSH or in your host's file manager from the WordPress root, and back everything up before changing anything.

This command finds every .user.ini under the current directory and prints any auto_prepend_file line. Look for a value pointing at a PHP file you do not recognize.

List .user.ini files and auto_prepend_file lines (run from the web root)Shell
find . -name ".user.ini" -exec grep -H "auto_prepend_file" {} \;

These commands show whether the two drop-ins exist, list the mu-plugins folder, and find hidden dot-prefixed PHP files directly inside wp-content. Look for anything you did not install.

List drop-ins, mu-plugins and hidden dot-files in wp-content (run from the web root)Shell
ls -la wp-content/db.php wp-content/advanced-cache.php
ls -la wp-content/mu-plugins/
find wp-content -maxdepth 1 -name ".*.php"

These WP-CLI commands list must-use plugins and then all plugins. Look for unfamiliar entries, particularly a caching-style plugin you never added.

List must-use and installed plugins (run from the web root)WP-CLI
wp plugin list --status=must-use
wp plugin list

Finally, open the active theme's functions.php and scan the bottom for an appended block fenced by begin and end markers.

Legitimate caching plugins can use advanced-cache.php, and some use db.php. Compare against what you actually installed instead of deleting on sight.

What to do now

Caution. Do not just delete the file named in an auto_prepend_file line. Sucuri says that removing it while PHP's cached value is warm makes every PHP request on the account fail until the cache expires. Work from a backup.

Sucuri's own cleanup order is not in the excerpt we have, so read it in the original post first. The items below are general incident-response advice, not Sucuri's sequence.

For the broader process, see our guides on what to do when a website is hacked and how to check whether a website is hacked.

Detection and monitoring afterwards

SC can run before WordPress loads, so a normal-looking dashboard proves little. After cleanup, repeat the checks above following a few page loads and again the next day, since Sucuri describes rebuilds occurring on page load. Compare core and plugin files with known-good copies and review changes in wp-content and theme files.

An outside-in scan can flag some symptoms but cannot see files, shared memory or database rows, so read what outside-in malware detection can and cannot see. The free website malware scanner can serve as one extra signal, and the WordPress security checklist covers hardening such as limiting who can write to wp-content.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoorblog.sucuri.net ·
  • WordPress
  • malware
  • backdoor
  • Sucuri
  • incident response