The Rose Approach
The site stopped loading. It had been compromised, and nobody knew for how long.
What was wrong
The site stopped loading.
It had been compromised. There was injected content through the site and base64-encoded code sitting in files that had no business containing any. By the time it took the site down, whoever put it there had been in for a while.
The most likely way in was an out-of-date plugin. I can’t prove that. What I could establish was what they’d done once they were in.
What I did
Cleaned it in place. A restore would have put the site back to a state that was already infected, just less obviously.
I rotated every credential and went looking for persistence. I found administrator accounts that shouldn’t have existed, and a backdoor left behind to get back in after the visible damage was cleaned up.
A site can look completely fine and still be sitting wide open. If you only remove what you can see, you get to do the whole thing again in a fortnight.
What changed
The site is back and clean. The ways in are closed.
There was a second problem I found while I was in there, unrelated to the malware. The domains were being held by a provider Rose struggled to get hold of. A question about her own domain could take days to come back. We moved them out, one at a time, until she controlled them herself.