WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Cybersecurity researchers detailed a WordPress compromise where threat actors used multiple persistence mechanisms to ensure a backdoor, codenamed SC after "SC_" markers, kept returning after cleanup. The malware, described by Sucuri as a "self-healing mesh", hides in files, the database, and shared memory, allowing it to rebuild itself without reinfecting the site. Site owners face repeated reinfections until all traces are removed.