0

This question already has an answer here:

Anyone have experience and advice to locate the source and stop an ftp hack on my client's Wordpress site hosted on BlueHost? The hackers were able to do the following:

  1. Create multiple ftp accounts with usernames like ss-ee4f8275917dfe28 etc. pointing to folders /tmp/simplescripts/ and /public_html/
  2. Upload php files with names like MMprobe-N5ayJ.php into the public_html folder

marked as duplicate by schroeder Jul 19 at 12:18

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    We cannot possibly know the source of an attack by looking at what they did afterwards. – schroeder Jul 19 at 12:11
  • Contact a professional to aid you. – MechMK1 Jul 19 at 17:48
0

The best scenario would be to take the last backup of the website and just re-create it fresh on a new server. You should contact their support for help. There could possibly be rootkits and other hidden stuff inside your application files, which could take a lot of time to weed out.

To prevent FTP attacks

  • use latest FTP service version
  • use strong username, password
  • setup fail2ban on FTP to prevent brute-force attacks

Not the answer you're looking for? Browse other questions tagged or ask your own question.