Backdoor WordPress SC Recupera Próprio Após Limpeza Com Múltiplos Mecanismos
Cybersecurity researchers have revealed a sophisticated WordPress compromise where threat actors deployed multiple persistence mechanisms to ensure continuous execution.
The backdoor, codenamed SC following the “SC_” markers in injected content, was described by Sucuri as a “self-healing mesh” operated through blockchain control.
“The payload lives in at least eight places at once, spread across files, the database, and shared memory,”
said security researcher Gabriel Barbosa.
When a plugin is deleted, a drop-in rewrites it. Removing the drop-in causes the theme to rewrite it. Cleaning every file on disk results in the entire set being restored from either the database or a shared-memory segment.
Sucuri characterizes the system as circular, noting there is no single point to remove to stop it.
- Hiding from admin plugins screens or update checks
- Communicating with a command-and-control server via Ethereum blockchain
- Fingerprinting the infected site and retrieving additional payloads
- Creating a hidden administrator account
- Running the reinfection loop
The malware operates without readable function names, instead employing a decoder to unscramble code using a substitution cipher.
Its capabilities enable operators to control the WordPress site, inject JavaScript to target visitors with skimmers, execute PHP code, and disable or delete specific plugins.
On Systems supporting System V shared memory, the payload resides in a segment identified by a fixed numeric key within RAM, allowing survival during file deletion and database cleanup.
Telemetry indicates fewer than twenty exploitation attempts targeting this vulnerability have occurred since July 3, 2026, originating from five distinct attacker IP addresses located in Bulgaria, Switzerland, France, the United States, and Yemen.
High-severity unauthenticated SQL injection flaw in the wpForo Forum WordPress plugin (CVE-2026-1581, CVSS score 7.5) affects all versions up to 2.4.14.
Security teams face challenges due to limited visibility and governance over AI-driven access expansion within enterprises.
Com informações de: The Hacker News (THN)