[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6OqL4oL9XMyuNFSBpRW1fDRsVxMnnX9jT0uP2_TmdS0":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"c38a6a36-3253-4a54-83f7-f2cb6b09c291","SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor","sc-wordpress-malware-a-self-healing-mesh-of-loaders-drop-ins-and-a-blockchain-co-1fd76d","Overview During recent website cleanup work, we analyzed a WordPress compromise where the same backdoor kept returning within seconds of every removal, no matter how carefully the visible files were deleted. Throughout this article, we’ll refer to this family of malware as SC, named after the “SC_” markers found in the injected content. What makes SC worth documenting is how it survives. The payload lives in at least eight places at once, spread across files, the database, and shared memory, and every one of those places can rebuild all the others. Continue reading SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor at Sucuri Blog.","A new WordPress malware family, dubbed SC, has been identified that employs a sophisticated self-healing mechanism to ensure its persistence. The malware resides in at least eight locations simultaneously, including files, the database, and shared memory, with each component capable of rebuilding the others. This circular system makes traditional cleanup methods ineffective, as removing one part of the infection triggers another to restore it.","SC WordPress malware uses a self-healing mesh to survive deletions via multiple persistent components.","https:\u002F\u002Fblog.sucuri.net\u002F2026\u002F09\u002Fsc-wordpress-malware-a-self-healing-mesh-of-loaders-drop-ins-and-a-blockchain-controlled-backdoor.html","https:\u002F\u002Fblog.sucuri.net\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FSC-WordPress-Malware.png","2026-10-01T00:57:15+00:00","2026-10-01T04:00:03.494874+00:00",8,[17,20,23,25],{"name":18,"type":19},"WordPress","product",{"name":21,"type":22},"PHP","technology",{"name":24,"type":22},"shared memory",{"name":26,"type":22},"blockchain","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":84,"name":85,"problem":86,"products":87},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":159},"self-healing-wordpress-malware-defeats-traditional-cleanup-methods","Self-Healing WordPress Malware Defeats Traditional Cleanup Methods","The SC WordPress malware family demonstrates an advanced persistence strategy by distributing itself across at least eight locations simultaneously — files, the database, and shared memory — creating a circular self-healing mesh where each component can reconstruct the others. This means conventional malware removal techniques (deleting infected files or clearing the database) are rendered ineffective, as surviving components silently restore what was removed. The use of a blockchain-controlled backdoor adds a decentralized command-and-control layer that is extremely difficult to disrupt or block via traditional network controls. This attack highlights the critical importance of integrity monitoring, hardened WordPress configurations, and thorough forensic incident response procedures. Organizations relying on surface-level scans or manual cleanup without understanding the full infection surface will remain persistently compromised.",[147,148,149,150,151,152,153,154,155,156,157,158],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 8 – Audit Log Management","CIS Control 10 – Malware Defenses","CIS Control 11 – Data Recovery","NIST SP 800-61 Rev. 2 – Incident Response (Eradication & Recovery phases)","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity","NIST SP 800-53 AU-2 – Event Logging","NIST SP 800-53 CP-9 – System Backup","ITIL 4 – Incident Management Practice","OWASP Top 10 A05:2021 – Security Misconfiguration","GDPR Article 32 – Security of Processing (integrity and availability controls)",{}]