Malware recovery

The incident

Three WordPress sites on a single IONOS shared-hosting account were hit by a gambling and casino spam injection. Infected files had been dropped across the account, including into the WordPress cache folders, and the host had started flagging and locking files automatically, which was taking parts of the sites offline. It had to be handled the same day.

What I found

The entry point traced back to a nulled plugin. From there the infection had spread across the shared account, dropping injected files and backdoors into more than one site.

What I did

• Cleaned every infected file over FTP. I went through the whole hosting account file by file, removed the injected code and backdoors from all three sites, and cleared the malicious files the host had quarantined.
• Reinstalled WordPress core on each site, so nothing that had been tampered with was left running.
• Rotated every credential. The hosting control panel, all databases, and every WordPress admin account got new passwords, so any leaked login was useless.
• Removed the root cause and hardened each install, replacing the nulled plugin and locking down file permissions so the same door could not be used again.
• Put monitoring in place to catch any re-infection early.

Technical detail

The hard part was not spotting the injection, it was doing the cleanup properly across a shared account. Cleaning the visible files is not enough if a backdoor or a leaked password is left behind, so the job only counts as done once the core is reinstalled, every credential is rotated, and the entry point is closed. All three sites were back and clean within a single day, but that day was intensive manual work, not a one-click scan.

Outcome

Three sites recovered and hardened in a day, the root cause removed, and monitoring in place so it would not happen again.