Webshell replicated across multiple website directories
An anonymized case where the same upload backdoor was found in images, media and template directories.
A small brochure site outside healthcare. The previous intervention consisted of deleting the malicious file that had been found. Shortly afterwards the site behaved exactly as before — which is the most common scenario we see with repeat infections.
What we found
The audit uncovered eight randomly named PHP files carrying the same web shell signature. They were not only in the images directory but also in templates and media, and several had further copies in subdirectories. The shell included an upload form and operations for moving, copying and writing files — everything it needed to keep replicating itself.
The database held an inventory of the same files across multiple paths, plus traces of earlier deletion attempts. The original entry vector could not be established with certainty — and saying so is more honest than reverse-engineering a cause after the fact.
How we handled it
The decisive step was inventorying the copies by content, not by filename. Randomly generated names mean that searching by name only finds the copy you already know about.
After removing the shells we went through the image, media and template directories, restored the template and framework from trusted packages, and reviewed backend accounts, session records and access logs. Then came rotation of the Joomla, FTP/SFTP, database and hosting credentials, multi-factor authentication, and write restrictions on publicly reachable asset directories. We closed the work with a repeat scan and a fresh clean backup.
Outcome
What mattered was not deleting the first file found but locating every identical copy across the site and restoring trustworthy components. Restricting writes to the asset directories also removed the mechanism the malware had been spreading through.
The takeaway
Randomly named PHP files in directories that should only hold images, media or a template oblige you to review the whole webroot, the backups and the database inventory. One removed copy does not close an incident — and the directory you assume holds “just images” is exactly where malware hides.