Epic Flooring Solutions

Epic Flooring's managed WordPress site had a self-healing backdoor kit that had been escalating over four months: a hidden administrator account concealed by a WPCode snippet, a beacon cron firing every 60 seconds to phone home, fake “EasyPost” and SEO plugins side-loaded from the uploads folder, an admin-menu hider, a second rogue admin added months later, and Wordfence quietly switched off.

• Identified patient zero (the first hidden admin), the concealment snippet created seconds after it, the persistence cron, and the second-wave rogue admin.
• Distinguished the genuinely malicious every-60-seconds heartbeat cron from ordinary WordPress scheduler hashes — and, on verification, corrected my own first-pass report where two legitimate Action Scheduler hashes had been over-flagged.
• Verified the cleaned export and a 12,587-file wp-content snapshot: rogue admins fully removed, snippet store emptied, fake plugins gone from disk and config, Wordfence reactivated, no web-shells or PHP in uploads.
• Flagged the four-month multi-wave pattern as a server-level entry-vector signal, not a one-off.

The site came back verified clean — both rogue admins and their metadata gone, the fake plugins removed, casino spam pages cleared and their URLs now returning 404s. Just as important, I held myself to the same evidence standard I hold the malware to, publicly correcting a false-positive in my first report so the client's remediation stayed focused on what was actually malicious.

I corrected my own report mid-engagement. A security finding is only worth what its evidence is worth — including when the evidence goes against me.