Certain configuration files containing database connection information, such as IIS’s web.config and WordPress’s wp-config.php, must reside in the web document tree but are protected by other ...

The attackers were trying to download the wp-config.php WordPress configuration file which contains database credentials and connection info, besides authentication unique keys, and salts.

Attackers are using Eval PHP, an outdated legitimate WordPress plugin, to compromise websites by injecting stealthy backdoors.