SC WordPress Malware Rebuilds Itself From 8 Locations and Uses Ethereum for C2

The report describes the SC WordPress malware family that achieves robust persistence and stealth by spreading payloads across theme and plugin files, mu-plugins, WordPress drop-ins (db.php, advanced-cache.php), the database, scheduled tasks, and System V shared memory; it uses scrambled strings, hidden admin creation, and Ethereum smart-contract queries (EtherHiding) as a resilient command-and-control mechanism.