Compromised site recovery

The problem

Describe how the compromise was discovered and what it was doing, spam injection, redirects, outbound mail.

Approach

• A forensic copy taken before anything was modified, so the investigation was still possible after cleanup.
• Access and error logs plus file modification timestamps used to establish the entry point before any files were touched.
• CMS core and plugins replaced from clean upstream copies rather than disinfected file by file, and every credential rotated including database and FTP.
• Database checked for injected content, rogue administrator accounts and malicious scheduled tasks.
• Review requests submitted to Google Safe Browsing and Search Console, followed by file integrity monitoring for several weeks, the window in which a missed backdoor typically reactivates.