Loading story…
An unidentified threat actor compromised three servers supporting a shared parks and recreation management platform by registering member accounts and abusing an unrestricted upload feature that allowed uploaded ASPX files to execute from a public MemberFiles directory. The actor deployed webshells, enumerated IIS configurations and application source code, extracted database credentials, and searched Fortis payment-webhook logs and related components for cardholder data, including payment-card numbers, expiration dates, and CVVs.
After activity on two servers was removed, the actor used more evasive methods on a third, storing webshells under benign names and altering timestamps. When that server was restored to production, the intruder returned and used PowerShell to inject an obfuscated browser-side payload into a legitimate jQuery file served by the authentication page. The payload retrieved a second-stage agent through Cloudflare Workers and used encrypted WebRTC and WebSocket communications to capture user credentials in real time. Huntress reported a possible China nexus based on a zh-CN PowerShell user-agent string, but said the evidence does not support definitive attribution.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Huntress observed an unidentified actor begin a campaign against multiple tenants of a shared recreation-management platform, ultimately compromising three associated web servers. Initial unauthenticated techniques, including login brute forcing, IIS short-name enumeration, WebDAV abuse, and upload-handler bypass attempts, were unsuccessful.
The injected, obfuscated browser-side dropper loaded a second-stage script from Cloudflare Workers infrastructure and was intended to establish encrypted WebRTC and WebSocket communications. The payload was designed to harvest user credentials in real time.
The third server was returned to production before it was fully secured, allowing the actor to reuse its registered member account to regain access. The actor staged encoded PowerShell and JavaScript payloads in C:\Windows\Temp and used PowerShell planter scripts to modify a legitimate jQuery asset loaded by the authentication page.
After the first two servers were locked down, the actor compromised a third server and copied webshells into site directories under benign-looking names such as css_bundle.aspx and webresource.aspx. The actor timestomped the files and unsuccessfully attempted to add persistent copies to payment-module directories.
The actor used the same account-registration and malicious-upload technique against a second web server, conducting limited enumeration and searching for its uploaded webshells. Huntress's SOC removed the webshells from that server.
Using the first server’s webshells, the actor retrieved IIS and application configuration, searched source code and configuration files, and obtained database credentials. They queried for cardholder data and targeted payment integrations and Fortis webhook logs for card numbers, expiration dates, and CVVs.
The actor registered a platform member account and abused unrestricted execution of uploaded ASPX files in the publicly reachable MemberFiles directory to deploy webshells on the first server. The webshells supported host, IIS, network, process, and filesystem reconnaissance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
itsecurityguru.org
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor exploited an **SQL injection** flaw in a web page at a technology-sector organization, compromising an endpoint running **IIS** and **Microsoft SQL Server** and then carrying out extensive post-exploitation activity. Huntress reported the attacker used **base64-encoded PowerShell** for payload delivery, ran reconnaissance including `tasklist /svc`, and exfiltrated process information to an **OAST** domain. The actor then enabled **Remote Desktop Services**, created a new local administrator account named `adminweb2$`, and attempted to disable **Windows Defender** to retain access and reduce detection. The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known **BadIIS** modules using `appcmd.exe`, downloaded the **XMRig** cryptocurrency miner, hid miner-related files with `attrib.exe`, and used `nssm.exe` to keep the miner running persistently. Additional payloads included PowerShell and batch files such as `qdcjoke1.2.ps1`, `c_joke1.2.ps1`, and `qd_tjoke.bat`, along with **CnCrypt Protect**, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Jul 13, 2026
A threat actor repeatedly exploited or attempted to exploit a vulnerable Adobe ColdFusion server, then used IIS worker process `w3wp.exe` to run reconnaissance and deploy multiple steganographic webshells, including `UA4fp7R.aspx` and `WRBYTR5750images.aspx`. Huntress reported the intruder embedded the marker **ONEPIECE** in shell logic and maintained persistence across repeated restoration attempts, indicating the server was returned to production before remediation was complete. The intrusion escalated into broad defense impairment designed to preserve access and obstruct responders. The actor timestomped files, disabled IIS logging and Microsoft Defender, killed security and logging tools, removed the ModSecurity IIS module, and used Image File Execution Options debugger registry entries to neutralize Sysmon and Filebeat. The attacker also weakened credential protections by enabling `WDigest` `UseLogonCredential`, exported ODBC registry data, and used Mimikatz-style credential dumping to write passwords and hashes to files before Huntress disrupted the operation prior to data theft or ransomware deployment.
Jul 2, 2026
Palo Alto Networks Unit 42 reported a **previously undocumented Chinese threat actor**, tracked as **CL-UNK-1068**, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across **South, Southeast, and East Asia**. Targeted sectors include **aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications**, with Unit 42 assessing **moderate-to-high confidence** that the primary objective is **cyber espionage** (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution. The activity features exploitation of **internet-facing web servers** to deploy **web shells** and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and **living-off-the-land binaries (LOLBINs)**. Reported tooling includes **Godzilla** and **ANTSWORD** web shells, the **Xnote** Linux backdoor, and **Fast Reverse Proxy (FRP)** for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., `c:\inetpub\wwwroot`) focusing on files such as `web.config`, `.aspx`, `.asmx`, `.asax`, and `.dll`, consistent with credential access and follow-on exploitation discovery.
Jun 29, 2026