Malware

sc

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.003CronEvidence1

The infection registers cron hooks, including randomized names alongside a known fetch hook. System cron runs the WordPress cron file... then triggers redeployment on schedule.

Persistence

4 techniques

T1053.003CronEvidence1

The infection registers cron hooks, including randomized names alongside a known fetch hook. System cron runs the WordPress cron file... then triggers redeployment on schedule.

T1136.001Local AccountEvidence1

It either adopts an existing hidden admin or generates a new one, writing the account directly into the users and usermeta tables when the normal API is unavailable.

T1505.003Web ShellEvidence1

The actual malware is a large WordPress-aware file installed as both a must-use plugin and a normal plugin... [with] multiple persistence and remote-control capabilities.

T1546Event Triggered ExecutionEvidence1

A single line, auto_prepend_file, points PHP at a loader that runs before every request in that directory tree.

Privilege Escalation

3 techniques

T1053.003CronEvidence1

The infection registers cron hooks, including randomized names alongside a known fetch hook. System cron runs the WordPress cron file... then triggers redeployment on schedule.

T1546Event Triggered ExecutionEvidence1

A single line, auto_prepend_file, points PHP at a loader that runs before every request in that directory tree.

T1548.001Setuid and SetgidEvidence1

A tool to run a root shell ( /bin/sh ) by forcing setuid 0 and setgid 0 or setuid to a user defined value.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

Every SC file ... carries a table of scrambled strings and a small decoder that resolves a numeric index into a real function name through a positional substitution cipher.

T1564Hide ArtifactsEvidence1

It filters the plugin list, the update transient, and the site and network plugin views to remove its own entry... It also emits admin JavaScript to scrub itself from the plugin table.

Credential Access

2 techniques

T1056.003Web Portal CaptureEvidence1

The reply can carry front-end JavaScript to inject (which, on a store, enables checkout skimming).

T1606.001Web CookiesEvidence1

It also forges valid authentication cookies for that account, so the operator can log in without a password.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

It collects the site URL and host, the WordPress and plugin versions, path hashes, the active themes, the mu-plugin list, and the current administrator session tokens.

Collection

2 techniques

T1056.003Web Portal CaptureEvidence1

The reply can carry front-end JavaScript to inject (which, on a store, enables checkout skimming).

T1074Data StagedEvidence1

The full payload sits in an options row under a random name... Shared memory... [and] a ZIP restore bundle with a random hex name.

Command and Control

2 techniques

T1102.002Bidirectional CommunicationEvidence1

Rather than a single hardcoded server, the payload carries a list of roughly twenty public Ethereum RPC gateways... to read instructions from a smart contract.

T1105Ingress Tool TransferEvidence1

The reply can carry ... new PHP to install... [and] the loaders rebuild the plugin from existing copies, an encoded cache stub, ZIP bundle, shared memory, or database.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

[It] encrypts that bundle, and posts it to the resolved endpoint.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

When told to remove a security plugin, it can deactivate it, wipe its directory, and even reassign or elevate another account first.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sucuri blogNews

Oct 1, 2026

SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor

A highly persistent WordPress backdoor mesh that self-restores from multiple on-disk and off-disk locations. It hides its plugin and administrator account, maintains redundant plugin copies, obtains command-and-control instructions through public Ethereum RPC gateways and smart-contract selectors, fingerprints compromised sites, can deploy additional PHP or front-end JavaScript including checkout skimmers, disables security plugins, creates or restores hidden administrator accounts, forges authentication cookies, and regenerates its full persistence chain.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

sc

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.003CronEvidence1

The infection registers cron hooks, including randomized names alongside a known fetch hook. System cron runs the WordPress cron file... then triggers redeployment on schedule.

Persistence

4 techniques

T1053.003CronEvidence1

The infection registers cron hooks, including randomized names alongside a known fetch hook. System cron runs the WordPress cron file... then triggers redeployment on schedule.

T1136.001Local AccountEvidence1

It either adopts an existing hidden admin or generates a new one, writing the account directly into the users and usermeta tables when the normal API is unavailable.

T1505.003Web ShellEvidence1

The actual malware is a large WordPress-aware file installed as both a must-use plugin and a normal plugin... [with] multiple persistence and remote-control capabilities.

T1546Event Triggered ExecutionEvidence1

A single line, auto_prepend_file, points PHP at a loader that runs before every request in that directory tree.

Privilege Escalation

3 techniques

T1053.003CronEvidence1

The infection registers cron hooks, including randomized names alongside a known fetch hook. System cron runs the WordPress cron file... then triggers redeployment on schedule.

T1546Event Triggered ExecutionEvidence1

A single line, auto_prepend_file, points PHP at a loader that runs before every request in that directory tree.

T1548.001Setuid and SetgidEvidence1

A tool to run a root shell ( /bin/sh ) by forcing setuid 0 and setgid 0 or setuid to a user defined value.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

Every SC file ... carries a table of scrambled strings and a small decoder that resolves a numeric index into a real function name through a positional substitution cipher.

T1564Hide ArtifactsEvidence1

It filters the plugin list, the update transient, and the site and network plugin views to remove its own entry... It also emits admin JavaScript to scrub itself from the plugin table.

Credential Access

2 techniques

T1056.003Web Portal CaptureEvidence1

The reply can carry front-end JavaScript to inject (which, on a store, enables checkout skimming).

T1606.001Web CookiesEvidence1

It also forges valid authentication cookies for that account, so the operator can log in without a password.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

It collects the site URL and host, the WordPress and plugin versions, path hashes, the active themes, the mu-plugin list, and the current administrator session tokens.

Collection

2 techniques

T1056.003Web Portal CaptureEvidence1

The reply can carry front-end JavaScript to inject (which, on a store, enables checkout skimming).

T1074Data StagedEvidence1

The full payload sits in an options row under a random name... Shared memory... [and] a ZIP restore bundle with a random hex name.

Command and Control

2 techniques

T1102.002Bidirectional CommunicationEvidence1

Rather than a single hardcoded server, the payload carries a list of roughly twenty public Ethereum RPC gateways... to read instructions from a smart contract.

T1105Ingress Tool TransferEvidence1

The reply can carry ... new PHP to install... [and] the loaders rebuild the plugin from existing copies, an encoded cache stub, ZIP bundle, shared memory, or database.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

[It] encrypts that bundle, and posts it to the resolved endpoint.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

When told to remove a security plugin, it can deactivate it, wipe its directory, and even reassign or elevate another account first.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sucuri blogNews

Oct 1, 2026

SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.