wpconsole – adware threat

We’ve had a site comprimised by this adware plugin. Trying to locate where it originates is problematic, but it seems to be uploaded via a ZIP file then runs some scripts to serve adware, and cache bust to ensure it gets served. WordFence was active on both sites previously, but was DEACTIVED when we found the plugin in place; not entirely sure how.

Command server for the ads appears to be https://mitccell.com/ (obviously don’t click that)

Anyone else seen this around?