Loading story…
Check Point researchers reported an active campaign by DarkCrewFriends targeting vulnerable PHP servers, especially content management sites, by abusing unrestricted file upload flaws to plant a malicious PHP web shell. The web shell then retrieves additional PHP and Perl payloads, establishes command-and-control over IRC, and gives operators broad post-compromise access including shell command execution, file transfer, port scanning, and service enumeration.
The malware also supports multiple distributed denial-of-service functions, including UDP, TCP, HTTP flood, IRC CTCP flood, and proxy-amplified attacks, indicating the compromised servers are being assembled into a flexible botnet infrastructure. Check Point linked the activity to DarkCrewFriends through web-shell signatures, bot administrator identifiers, forum activity tied to the user SOULDRK, and infrastructure such as pkalexeivic[.]com and lubrisabana[.]com, warning that the operation could be used for data theft, system damage, and service disruption.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point researchers Liron Yosefian and Ori Hamama reported an ongoing campaign attributed to DarkCrewFriends targeting PHP servers, especially content management sites, by exploiting unrestricted file upload flaws to deploy PHP web shells and additional payloads. The report linked the activity to DarkCrewFriends through web shell signatures, administrator identifiers, forum activity by SOULDRK, and infrastructure including pkalexeivic[.]com and lubrisabana[.]com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 121 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026
An exposed server tied to the **WP-SHELLSTORM** cybercrime operation revealed tooling, logs, command history, and target lists for a large-scale webshell campaign aimed primarily at **WordPress** sites, with additional targeting of **Joomla** and enterprise Java platforms. Researchers said the group scanned more than **1.4 million domains**, exploited **27 CVEs**—including the Breeze plugin flaw `CVE-2026-3844`—and maintained roughly **5,700 active webshells**, while some analysis put validated compromises as high as **25,195**. The operation used layered implants including BestShell-derived webshells, a **SNOWLIGHT** dropper, and a **VShell** payload disguised as a Linux `kworker` process, then resold access to compromised websites. The exposed infrastructure also linked the operators to a separate campaign against **Nacos** deployments, where they exploited the authentication bypass `CVE-2021-29441` and stole **613 configuration files** from **11 systems** across **nine organizations**. Investigators assessed the activity with medium-to-high confidence as **financially motivated** and likely conducted by **Chinese or Chinese-speaking** operators rather than a state-backed APT, citing Simplified Chinese artifacts, FOFA usage, and overlap between the web and Java intrusion sets. The operators reportedly tried to alter access logs after the server was discovered, but the exposure had already disclosed extensive indicators of compromise and operational details.
Jul 23, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026