Across WordPress fleets and hosting logs:

1. Access logs: POST / with User-Agent exactly WordPress/6.4; class-udrpc.php. Real UpdraftCentral Cloud traffic sends class-udrpc.php/2.0; https://teamupdraft.com. Source IPs 43.250.53[.]42 and 2a09:bac5:4e21:2e3c::49b:9, but Patchstack says the attacker rotated infrastructure, so don't rely on IPs alone. Nethemba's grep: grep 'class-udrpc.php"' access.log.
2. Backdoor triggers: GET requests with a parameter of _ plus 6 hex characters, or 12 hex characters, carrying a 32-character value, followed by a 302 to wp-admin (zgrep -E '[?&](_[0-9a-f]{6}|[0-9a-f]{12})=[^&" ]{32}[& ]').
3. UpdraftCentral client log (option updraftcentral_client_log, last 50 events only): probe.central.updraftplus.com, then Command received: plugin.upload_plugin or plugin.delete_plugin.
4. Files: plugins with the description "Small maintenance toolkit: keeps option storage tidy." or names like load-stack-35c, text-gantry-eb0, style-bridge-8f5, media-kit-183, boost-kit, cache-smith, site-health-364f, or "Site Health Cache" (the most reused name per Patchstack). Also check wp-content/upgrade/, where pushed plugins stay even if the install failed. Main-file SHA-256s are in Nethemba's IOC table, for example 3c3355f7…209f and bb40f9a8…0801.
5. Database: options matching *_sync_token, *_uid, *_installed, or site_health_364f_ver. Look for users with @example.org or @example.com emails, display names "Site Tools", "System Team" or "Web Tech", or Editors holding manage_options or install_plugins.

Nethemba publishes a read-only check script (run with wp eval-file check-updraftcentral.php --skip-plugins --skip-themes). Don't "fix" a crashing backdoor; one variant fails only because of a coding bug.