Short time after cleaning up the infection, the attacks renewed, bringing down the website on periodical basis.

After some digging, it looked like some Chinese based IPs were hitting xmlrpc.php on port 80 and brute forcing …