Executive Summary
A highly resilient malware family known as SC (or SC WordPress Malware) has been identified, characterized by its 'self-healing' architecture. The malware maintains persistence across at least eight different locations, including WordPress drop-in files, theme files, plugin directories, the database, and System V shared-memory segments. This redundant design ensures that if any single component is deleted, the remaining elements automatically regenerate the missing files and configurations on the next page load.
Technically, SC uses sophisticated obfuscation and unconventional C2 communication. It leverages public Ethereum RPC gateways to receive commands from smart contracts, effectively hiding malicious traffic within legitimate blockchain infrastructure. The payload includes capabilities for hiding its presence from the WordPress admin dashboard, creating hidden administrator accounts, and injecting JavaScript for activities such as credit card skimming.
This threat is particularly dangerous for e-commerce and high-traffic WordPress sites due to its ability to survive standard cleanup attempts. The circular dependency of its components means that failure to follow a precise cleanup sequence—neutralizing execution before deleting files—will result in immediate reinfection.