Two weeks ago when I tried to access one of my WordPress sites through the browser, I was redirected to an ad page. I went inside of the
public_html directory and found tons of
PHP files with random names (gibberish alphanumerical names). I also found out that a lot of WordPress
PHP files had been altered and had an
@include at the top which included random files (most of them had
ico extensions). This was not limited only to the site which was redirecting to an ad page, it was also happening to all the other WordPress sites in my
/var/www/ directory - they were all filled with malicious
I found a few files with incorrectly set up permissions and corrected them. I changed all the directory permissions to
755 and all the file permissions to
644. After using WordFense, I was able to eliminate all the malicious
PHP files and
@include statements and everything returned to normal.
Today however, I again found a ton of malicious
PHP files with gibberish alphanumerical names which do not belong. Going through the same process of deleting the malicious files and removing the
@include statements seems pointless as this will happen again - its just a matter of time.
How can the attacker generate these files where there is no other write-permitted files? I searched the entire system for write-permitted PHP files and couldn't find any.
Any idea has to how I can solve this?
Edit: We are sure that there is no SSH access. We went through the ssh auth logs several times and couldnt find any successful SSH connections.
We noticed changes in the chmod of several files. How is it possible to change file permission without having ssh access?
We found several users in the WP admin which were not created by us (admin users).
Our server is running on Ubuntu 18.04 - it is hosted on Digital Ocean. Our PHP version is 8.0.8. Our WordPress version 5.7.2