SC (Malware): news timeline & CVEs

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Sucuri details SC, a self-healing WordPress backdoor that rebuilds from files, the database, and RAM.

Sucuri analyzed a WordPress backdoor dubbed SC that stores the same payload in at least eight places across drop-ins, a fake hyper-engine-kit plugin, the theme, the database, and System V shared memory, so each copy can restore the others. The obfuscated payload hides from the admin UI, uses the Ethereum blockchain for command and control, creates a hidden administrator, runs PHP, and can inject JavaScript such as skimmers. Initial access is unknown. Separately, unauthenticated SQL injection CVE-2026-1581 in wpForo Forum through version 2.4.14 is being exploited, with fewer than 20 attempts from five IPs since July 3.

The Hacker NewsOct 1, 14:37 UTC · 1d agoMalware in the wild 4 sources CVE-2026-1581

WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor

Sucuri documented SC, a WordPress backdoor that restores itself from files, the database, memory, and Ethereum-based commands.

Sucuri documented a WordPress backdoor called SC that restores deleted malware within seconds. Copies live in plugins, themes, the database, shared memory, and early-loading PHP files, with scheduled tasks providing another redeployment path. The backdoor can hide administrator accounts, collect session tokens, forge authentication cookies, remove security plugins, and deliver browser scripts that could enable payment theft. It receives commands by querying smart contracts through roughly twenty public Ethereum gateways; Sucuri did not identify the initial entry point or the number of affected sites.

Cyber Security Newsupdated Oct 1, 14:37 UTC · 1d agofirst Oct 1, 13:45 UTC · 1d agoMalware in the wild 4 sources

SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence

SC WordPress malware rebuilds deleted backdoors from files, the database, cron, and shared memory.

Researchers including Sucuri analyzed a WordPress malware family called SC that rebuilds a deleted backdoor from interdependent components. Persistence includes .user.ini auto_prepend_file loaders, hidden PHP files, db.php and advanced-cache.php drop-ins, theme code, plugins, wp_options rows, ZIP archives, WordPress cron, and System V shared memory. Command-and-control uses public Ethereum JSON-RPC gateways and eth_call requests to smart contracts. The payload hides from admin screens, can disable security plugins, and on stores can inject checkout-skimming JavaScript.

GBHackersupdated Oct 1, 14:37 UTC · 1d agofirst Oct 1, 09:08 UTC · 1d agoMalware in the wild 4 sources

SC

Timeline3 articles

Related CVEsby mentions

Appears with

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor

SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence