A small UK business got an email from its hosting company saying malware had been detected on several of its websites.
Someone had had full control of the whole hosting account for over a year, and had been using the business's good name to run a scam.
It had "already been fixed"
This was not the first warning. The year before, Google had flagged the site for deceptive content and put up a warning to visitors. A clean-up at the time removed two fake plugins, the warning was lifted, and everyone moved on.
The attacker did not. When we looked properly, it was clear they had kept full access throughout and had carried on maintaining their foothold for months after that clean-up. We could prove it from the attacker's own files: they kept a list of their hidden backdoors, and that list had been rewritten after the clean-up, with removed backdoors crossed off and one replaced at a new size.
Why the first clean-up could not have worked
The earlier clean-up treated this as a website problem. It was an account problem.
The hosting account held eight WordPress installs, not one. Alongside the live site sat a staging copy, a development copy, and several old websites for other ventures that nobody had looked at in years. One of them belonged to a domain the business had let lapse, which had since been bought by someone else. Because most of these were stored inside the live site's folder, every one of them was reachable through the business's own web address. A backdoor in an abandoned old site was, in practice, a backdoor on the live one.
The attacker had added their own keys to the server. Two SSH keys in the account let them log straight in to the server with full access. No WordPress password change, plugin removal or website restore touches those.
