Tiziano Cialfi , Glad to hear That your problem has been solved. Sorry for Late response.
“Did you have locate the backdoor? ” => This attacker changes their domain name and files name when one of them server down by reporting spam or google blacklist. But I noticed and also heard from others that, Most of wordpress websites hosted with shared hosting servers are more affected.
Its like infection, One malware website spoiling other websites on shared host servers. Let me know if you find any clue.