Check this: https://www.bloggerguide.net/blog-platform/wordpress/wordpress-exploit-giving-backlinks-redirects-and-headaches-but-no-visitors/
There is written what to do in case of this kind of attack.
Searching for more and will post when will find something.