Now my question is where do they usually run this? Do they run it inside the hacked server or their own PCs?
Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.
They run it on your server, just like any other script runs (including WordPress).
In the log you provided, it looks like the hacker knew your password. Perhaps you are using the same password on other sites, and he somehow gained access to one of them?
Always set different and complex passwords; combine a large character range; include special characters and so on...
|show 2 more comments|