A common occurance I've found when doing forensics on compromised websites is a pattern like this:
<span>Clean code here</span> <!--0c0a22--> ... malware code here ... <!--/0c0a22--> <div>clean code resumes</div>
In particular, HTML code is delimited with
<!--marker--> ... <!--/marker-->, PHP code with
/*marker*/ ... /*/marker*/. Where the marker is some 6-character alphanumeric (possibly hexadecimal) value which varies by infection but is consistent throughout all the files infected in one go.
So my question is this:
Is there a common tool that produces this pattern, or is it perhaps a single individual or group? Or otherwise why is this pattern so consistent and common?