Hidden malicious content
Fake gambling-related posts had been created and were being hidden from normal website behaviour.
PEONIXIS CASE STUDY
WORDPRESS / SECURITY / MAINTENANCE
The WordPress Infection
That
Wouldn’t Stay Deleted
.
How a routine maintenance check uncovered a persistent WordPress compromise hiding beneath an otherwise functioning website.
Explore the investigation
A normal-looking website.
An infection that kept returning.
An infection that kept returning.
SURFACE / UNDERLYING SYSTEM
FIG. 01
W
WordPress
Surface
Resilient Backup
MU plugins
HIDDEN LAYER
MailPoint1360
Database
DEEPER INVESTIGATION
PERSISTENCE
↑
What you see ≠ what exists underneath
01 THE INCIDENT
It looked like
a plugin problem.
It wasn't.
During routine maintenance, an unusual plugin appeared in the WordPress installation: “Resilient Backup”.
It looked legitimate. But it could not be removed normally. Deleting it made the plugin disappear — only for it to return when checked again.
Every time it was deleted,
it came back.
Delete
→
Disappears
→
Check again
→
Returns
THE CYCLE CONTINUED
02 THE FIRST WARNING SIGN
WHAT VISITORS SAW
The website
The website
looked normal.
- Website functioning normally
- Front end accessible
- WordPress dashboard working
- No obvious visible indication of malicious activity
WHAT MAINTENANCE REVEALED
The environment
The environment
wasn't.
- Outdated plugin
- Unauthorized access / malicious activity
- Additional files and components
- Fake “Resilient Backup” plugin
03 WHEN DELETING IT DIDN'T WORK
Delete
Plugin disappeared
Check again
It was back.
THE QUESTION CHANGED
Not: “How do we delete this plugin?”
But:
“What keeps
putting it back?”
04 LOOKING BENEATH WORDPRESS
The investigation
went deeper.
The investigation moved beyond the normal WordPress plugin screen and into the underlying environment.
A suspicious MU plugin was identified: MailPoint1360. The visible plugin was only one part of the story.
0
1
WordPress Dashboard
0
2
Plugins
0
3
MU Plugins
MailPoint1360
0
4
Database
0
5
Hidden Components
05 THE VISIBLE PLUGIN WASN'T THE WHOLE STORY
WHAT THE DASHBOARD SHOWED
Resilient Backup
VISIBLE SYMPTOMWHAT THE BACKEND INVESTIGATION REVEALED
MailPoint1360
UNDERLYING MECHANISM
THE TURNING POINT
The malicious components were part of a broader persistence mechanism. The relationship with the null plugin was identified.
Once the null plugin was deactivated, the fake Resilient Backup plugin could finally be removed successfully.
Visible symptom
→
Underlying mechanism
→
Successful removal
06 BEYOND PLUGINS
The compromise
went beyond plugins.
0
1
Plugins
0
2
MU plugins
0
3
Database activity
0
4
WordPress content
0
5
User accounts
0
6
Website behaviour
An attacker-created user
An attacker-created username was identified and could not simply be removed through the normal WordPress process.
07 FOLLOWING THE EVIDENCE
Every finding revealed
another layer.
SURFACE → ROOT CAUSE
-
0
1
Entry point
An outdated plugin was associated with unauthorized access and malicious activity.
-
0
2
Malicious component
The unfamiliar “Resilient Backup” plugin appeared legitimate.
-
0
3
Persistence
Deleting the fake plugin did not stop it from being recreated.
-
0
4
MU plugin
The investigation identified the suspicious MailPoint1360 MU plugin.
-
0
5
Database
An associated database script was identified during the deeper investigation.
-
0
6
Malicious content
Fake gambling-related posts were hidden from normal website behaviour.
-
0
7
User account
An attacker-created user could not simply be removed through the normal WordPress process.
08 THE CLEANUP
The objective wasn't simply to make the visible plugin disappear.
It was to address the components responsible for persistence and compromise.
IDENTIFIED COMPONENTS
INVESTIGATED → REMOVED
Fake Resilient Backup plugin
Identified persistence mechanism
Suspicious MailPoint1360 MU plugin
Associated database script
Fake gambling-related posts
Attacker-created WordPress user
09 THE RESULT
Not just removed.
Understood.
- Identified malicious components were removed
- Fake plugin stopped being recreated
- Malicious gambling content was removed
- Attacker-created account was addressed
The website was brought back to a clean state from the perspective of the components identified during the investigation.
The most important result wasn't simply removing the malware.
It was understanding
why it kept coming back
in the first place.
10 WHY THIS INCIDENT MATTERED
The website looked normal.
That was part
of the problem.
A compromised WordPress website does not necessarily look broken. Pages can continue serving. Forms can continue working. The dashboard can remain accessible.
The website can appear completely normal to visitors while malicious components still exist behind the scenes.
The real story was inside the WordPress installation.
11 THE ATTACK CHAIN
A seemingly small issue.
A multi-layered compromise.
- 01 Outdated plugin
- 02 Unauthorized access
- 03 Malicious components introduced
- 04 Fake “Resilient Backup” plugin
- 05 Persistence mechanism
- 06 MailPoint1360 MU plugin
- 07 Database script
- 08 Hidden gambling content
- 09 Attacker-created user
- 10 Detection during maintenance
- 11 Investigation
- 12 Cleanup
- 13 Malicious components removed
SURFACE → INVESTIGATION → UNDERLYING SYSTEM → ROOT CAUSE → RESOLUTION
12 WHAT THIS INCIDENT REVEALED
Deleting malware does not
always remove the infection.
Persistence matters
If another component is responsible for recreating a malicious file or plugin, repeatedly deleting the visible component does not address the underlying problem.
MU plugins require special attention
MU plugins behave differently from conventional WordPress plugins and may not behave like normal dashboard plugins.
Database-level investigation can matter
When suspicious behaviour continues, investigation may need to move deeper into the WordPress environment.
Malicious content can be designed to stay hidden
The fake gambling posts were designed so they did not appear normally during casual browsing.
13 THE PEONIXIS APPROACH
Our approach
follows the evidence.
-
0
1
Detect
Identify unusual behaviour, unfamiliar components and unexpected changes.
-
0
2
Investigate
Look beyond the visible symptom and examine the underlying WordPress environment.
-
0
3
Isolate
Understand which components are responsible for maintaining the unwanted behaviour.
-
0
4
Remove
Address the identified malicious components and persistence mechanisms.
-
0
5
Verify
Confirm that the unwanted behaviour is no longer occurring.
-
0
6
Protect
Keep the environment under appropriate maintenance and monitoring.
14 THE REAL TAKEAWAY
The most important discovery was not Resilient Backup.
It was the
mechanism behind it.
Because when malware can recreate itself, deleting the malware is only the beginning.
The goal isn't to make the symptom disappear.
The goal is to understand what caused it — and remove the mechanism behind it.
15 CASE STUDY SNAPSHOT
The investigation.
At a glance.
- Platform
- WordPress
- Incident Type
- Persistent WordPress compromise
- Primary Discovery
- Fake “Resilient Backup” plugin
- Persistence Component
- MailPoint1360 MU plugin and associated mechanisms
- Additional Findings
- Database script, fake gambling posts and attacker-created user
- Detection Method
- Routine maintenance
- Resolution
- Investigation and removal of identified malicious components
- Client Identity
- Anonymous
Client Confidentiality
The affected business has intentionally not been identified. No client name, domain, email address, username or identifying information is included in this case study.
YOUR WEBSITE MAY LOOK FINE.
That doesn't mean
everything underneath
it is fine
.
If your WordPress website is behaving strangely, unfamiliar plugins are appearing, deleted components keep returning, or something simply doesn't feel right, don't keep treating the symptoms.
Investigate the system behind them.
Web Development • Security • Maintenance • Growth
