Self‑Restoring WordPress Malware Recreates Deleted Backdoor in Seconds

A newly identified WordPress threat, labeled the SC family because of the "SC_" strings it embeds in compromised code, can regenerate a removed backdoor almost instantly by leveraging both database entries and in‑memory data.

Security researchers who first examined the malware reported that the code establishes a persistence mesh that constantly checks for the presence of its own components. If a file containing the backdoor is deleted, the mesh pulls the missing payload from a hidden database record or from data cached in server memory, recreating the malicious file within seconds.

The SC architecture differs from many older WordPress infections that depend on a single web shell, malicious plugin, or vulnerable theme. Instead of a lone entry point, SC spreads small code fragments across multiple locations, each capable of re‑assembling the core backdoor. The markers "SC_" appear in each fragment, allowing the components to recognize one another and coordinate reconstruction.

Analysts noted that the malware does not require a specific vulnerable plugin to gain initial access; once it infiltrates a site—often through compromised credentials or outdated core files—it plants its distributed components and begins the self‑healing cycle. This design makes conventional cleanup methods, such as deleting the visible shell file, largely ineffective.

Website administrators are advised to treat infections with SC as a systemic issue rather than a single file problem. Comprehensive scans that examine database tables, file system integrity, and running processes are necessary to locate all hidden fragments. Restoring from a clean backup that predates the infection remains one of the most reliable remediation steps.

The emergence of SC highlights a broader trend in WordPress‑focused malware toward more resilient persistence mechanisms. As the platform powers roughly 40% of all websites, attackers continue to invest in techniques that can survive routine hardening measures and evade detection.

Security vendors are already working on signatures that can spot the "SC_" markers and the unusual database patterns associated with the mesh. In the meantime, experts recommend keeping WordPress core, themes, and plugins up to date, enforcing strong authentication, and employing monitoring tools that can detect sudden file recreation or anomalous database activity.