Roger Elve on "[Plugin: WP Super Cache] Suspicious folders at /wp-content/cache/supercache folder"

In short, the client (bot or whatever) is supplying a fake host header causing WPSuperCache to write a new folder.
A simple fix would be to check the HTTP_HOST variable against a valid list of hosts in your .htaccess file.

You can see a proof of concept here: https://youtu.be/CkYUFr86bCA