Removing an APT from a WordPress Blog

In a recent article I talked about the dangers of using nulled plugins (https://blog.cardoso.work/en/wordpress-and-the-danger-of-nulled-plugins-and-themes/), because they can come with backdoors that let a sufficiently sophisticated adversary, in this case an APT (https://www.kaspersky.com/resource-center/definitions/advanced-persistent-threats), break into your WordPress instance and use it for shady purposes.

In this case, the malware was quite sophisticated: it infected several WordPress files and created randomly named files that were backdoors, so that if the WordPress files were replaced, it would still have multiple paths to reinfection.

It took several tools and manual code editing, plus blocking the IPs that were making the requests, to isolate the threat.

Some of the tools used were Sucuri Scanner (https://wordpress.org/plugins/sucuri-scanner/), together with Wordfence CLI (https://github.com/wordfence/wordfence-cli) and Ninja Scanner (https://wordpress.org/plugins/ninjascanner/).

With these tools, I had the path of each infected file, and I either removed the malicious code or deleted the file. Slow work, but it paid off.

So, even though it is possible to get rid of a threat like this through hard work, the best option is to avoid nulled plugins.