Mr_Rot13
Mr_Rot13 is a threat actor tracked by QiAnXin XLab and linked to active exploitation of the critical cPanel & WHM authentication bypass vulnerability CVE-2026-41940. The group has been attributed to automated attacks against exposed Linux hosting environments, with researchers reporting more than 2,000 attacker source IPs involved globally. Reported follow-on activity associated with exploitation includes backdoor deployment, credential theft, cryptomining, ransomware, and botnet propagation. In the intrusion chain described in the content, Mr_Rot13 uses a shell script to download a Go-based infector referred to as Payload from infrastructure including cp.dene.de.com. The malware changes the root password, implants an SSH public key for persistence, drops a PHP webshell at /usr/local/cpanel/cgi-sys/cpanel.py, modifies the cPanel login page with malicious JavaScript to steal usernames and passwords, collects bash history, SSH data, device information, database passwords, and valiases data, and exfiltrates data to attacker infrastructure and a Telegram group. The JavaScript hides its credential-theft endpoint using ROT13, decoding to wrned.com. The campaign ultimately installs a cross-platform remote-control trojan/backdoor named Filemanager, delivered via wpsock.com, which supports file management, remote command execution, shell access, and has builds for Linux, Windows, and macOS. XLab states the actor name was derived from the Telegram creator handle "0xWR" and the use of ROT13 obfuscation in the operation. The content also links Mr_Rot13 to older activity involving a PHP backdoor named helper.php that communicated with wrned.com, indicating the group may have operated since at least 2020 and has used stable long-lived infrastructure with low detection rates. The content additionally states that WordPress was also targeted in related activity. Known associated aliases and identifiers mentioned in the content are Mr_Rot13, mr_rot13, and the Telegram handle 0xWR.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Tradecraft
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
4 malware families attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
20 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Actively exploiting CVE-2026-41940 to compromise exposed Linux hosting environments using an automated infection chain for persistence, credential theft, and backdoor installation.
Exploiting the cPanel/WebHost Manager authentication bypass vulnerability CVE-2026-41940 to compromise systems, deploy the Filemanager backdoor, establish persistence, steal credentials and sensitive data, and enable follow-on activity including cryptocurrency mining, ransomware deployment, botnet propagation, and cross-platform backdoor installation.
Long-running threat actor linked to exploitation of CVE-2026-41940 in cPanel to deploy the Go-based Payload malware and the Filemanager backdoor, steal credentials, establish persistence, exfiltrate data, and target WordPress/cPanel environments.
Active exploitation of CVE-2026-41940 against cPanel/WHM systems, deploying the Filemanager backdoor, stealing credentials, establishing persistence on Linux hosting environments, and conducting follow-on activity including cryptocurrency mining, ransomware deployment, botnet propagation, and backdoor implantation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.