We've handled 12 WordPress recoveries with the same technical signature: PHP files with double extensions in the mu-plugins directory, invisible to most commercial scanners.