Loading story…
An exposed server tied to the WP-SHELLSTORM cybercrime operation revealed tooling, logs, command history, and target lists for a large-scale webshell campaign aimed primarily at WordPress sites, with additional targeting of Joomla and enterprise Java platforms. Researchers said the group scanned more than 1.4 million domains, exploited 27 CVEs—including the Breeze plugin flaw CVE-2026-3844—and maintained roughly 5,700 active webshells, while some analysis put validated compromises as high as 25,195. The operation used layered implants including BestShell-derived webshells, a SNOWLIGHT dropper, and a VShell payload disguised as a Linux kworker process, then resold access to compromised websites.
The exposed infrastructure also linked the operators to a separate campaign against Nacos deployments, where they exploited the authentication bypass CVE-2021-29441 and stole 613 configuration files from 11 systems across nine organizations. Investigators assessed the activity with medium-to-high confidence as financially motivated and likely conducted by Chinese or Chinese-speaking operators rather than a state-backed APT, citing Simplified Chinese artifacts, FOFA usage, and overlap between the web and Java intrusion sets. The operators reportedly tried to alter access logs after the server was discovered, but the exposure had already disclosed extensive indicators of compromise and operational details.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The report said WP-SHELLSTORM weaponized 27 CVEs affecting WordPress plugins and Joomla components, and linked the operation to follow-on tooling including the SNOWLIGHT stager and the VShell implant. Researchers also published indicators such as IP addresses, a domain, and a SHA-256 hash for a primary webshell.
After apparently realizing the exposed server had been discovered, the actor appeared to modify or tamper with access logs. By that point, the exposure had already revealed substantial operational details and indicators of compromise.
Based on artifacts including FOFA usage, Simplified Chinese traces, and overlap between the WordPress and Java activity, researchers assessed with medium-to-high confidence that the operators were Chinese or Chinese-speaking. They judged the campaign to be professional and financially motivated rather than state-directed.
The exposed data showed a financially motivated webshell access-brokerage operation targeting more than 1.4 million domains, primarily exploiting WordPress and Joomla vulnerabilities at scale. Researchers said the figure reflected scanned targets, while compromise estimates ranged from about 5,700 active webshells to 25,195 validated compromises.
In May 2026, the actor exploited Nacos authentication bypass CVE-2021-29441 in a related campaign and stole 613 configuration files from 11 victim systems across nine organizations.
Researchers discovered that a Python SimpleHTTPServer directory on 137.175.93[.]126 was exposed for 22 days, revealing the operator's tools, logs, target lists, and command infrastructure for the WP-SHELLSTORM operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourcesocradar.io
Open sourcectrlaltintel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Australia’s ACSC warned of a large-scale global campaign exploiting vulnerable content management systems and plugins to install webshells on internet-facing web servers, with many small and medium-sized Australian businesses affected. Attackers are scanning for known flaws in **WordPress plugins** and other CMS platforms including **Craft CMS**, **MaxSite CMS**, **MetInfo CMS**, and **Joomla JCE**, abusing weaknesses such as unauthenticated file upload, remote code execution, server-side request forgery, and unsafe deserialization. The implanted webshells give attackers persistent remote access that can be used for website defacement, credential theft, malware delivery, and deeper network intrusion. ACSC said organizations should treat any server hosting a webshell as **fully compromised**, isolate affected systems, inspect logs for lateral movement and persistence, restore from known-good backups after patching, and reduce future exposure by rapidly applying patches, disabling vulnerable plugins, restricting file creation and execution paths, monitoring child processes, and limiting connectivity between public-facing web servers and internal networks.
Jul 15, 2026
Researchers reported a large-scale software supply chain campaign that abused compromised GitHub repositories and malicious GitHub Actions workflows to turn GitHub-hosted Ubuntu runners into disposable scanning and exploitation infrastructure. The activity was first linked to ten Packagist PHP packages associated with the legitimate developer account **dinushchathurya**, but the PHP packages themselves were benign; the malicious execution path came from injected workflow files committed to the repositories. Investigators identified 583 malicious workflow files in the initial cluster, all tied by code reuse and a shared DNSHook callback, with payloads downloaded from `43[.]228[.]157[.]68`. The workflows scanned internet-facing systems and attempted to exploit **cPanel** and **WHM** authentication bypass flaw `CVE-2026-41940`, then exfiltrated harvested credentials and configuration data. Stolen material reportedly included cloud keys, source-control tokens, API credentials, database secrets, and SSH-related data from exposed servers. Researchers said the campaign was far broader than one maintainer account, finding about **6,100** linked workflow files and **15,000 to 16,000** additional files matching related indicators across GitHub, and warned the operation likely remains active through forks, mirrors, cached snapshots, stolen credentials, and surviving attacker infrastructure.
Jul 24, 2026
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Jun 29, 2026