Self‑Repairing WordPress Backdoor Uses Files, Database and Shared Memory to Persist

Security analysts have uncovered a sophisticated WordPress intrusion in which the malicious code can re‑establish itself after a site administrator removes it. The backdoor, identified by researchers as "SC" because of the distinctive "SC_" markers it leaves in the compromised environment, employs three separate persistence techniques that allow the final payload to reappear without a fresh infection.

According to the investigation, the attackers first drop a lightweight loader into the web root. That loader writes auxiliary scripts to hidden directories, creates custom entries in the WordPress database, and allocates a shared memory segment that holds a copy of the malicious payload. Each of these components monitors the others; if one is deleted, the remaining elements can reconstruct the missing piece, effectively rebuilding the backdoor from within the site itself.

The use of shared memory is unusual in typical web‑application compromises. By storing part of the code in a volatile memory region, the attackers ensure that even if file‑system scans flag the malicious scripts, the payload can be regenerated from the memory copy the next time the site processes a request. The database entries, often disguised as innocuous options or transients, serve as a persistent stash that survives file‑level clean‑ups and can be re‑executed by the loader.

WordPress powers a significant share of the internet, and its extensible architecture makes it a frequent target for automated attacks. The discovery of a backdoor that can resurrect itself raises the bar for remediation, as conventional file‑based malware removal may no longer be sufficient. Site owners who rely solely on plugin updates or file integrity checks could find the infection returning weeks after a cleanup.

Researchers recommend a multi‑layered response: verify the integrity of core files, audit the options table for unexpected entries, and monitor system memory for anomalous shared segments. Deploying host‑based intrusion detection systems that can flag the creation of unknown memory objects, combined with regular database reviews, can help break the persistence loop. As the technique gains visibility, security vendors are expected to update their scanning signatures to detect the "SC_" markers and associated patterns, giving administrators a better chance to eradicate the threat before it can rebuild itself.