Active Threat Campaigns

Targeted probing for exposed AWS credential files and EC2 instance metadata endpoints. Successful exfiltration of ~/.aws/credentials or IAM role tokens from the metadata service enables full AWS account takeover: EC2/S3/RDS access, IAM privilege escalation, and cryptocurrency mining on large instances. Primary actor observed using the LeakIX l9explore/1.2.2 mass scanner.

A path normalisation flaw in Apache 2.4.49 (CVE-2021-41773) and 2.4.50 (CVE-2021-42013) allows attackers to map URLs outside the expected document root using encoded dot-dot sequences. When mod_cgi is enabled, this escalates to RCE. Massively exploited within hours of disclosure.

Probes for unauthenticated access to the Docker daemon REST API (default port 2375/2376). An exposed Docker socket allows full container enumeration, new container creation with host filesystem mounts, and trivial escape to root on the host. Also used as a second-stage probe by multi-vector botnets (e.g. libredtail-http) after initial web exploitation to pivot to container infrastructure.

ProxyLogon is a chain of vulnerabilities in Microsoft Exchange (CVE-2021-26855 SSRF + CVE-2021-27065 file write) that allows unauthenticated attackers to execute arbitrary code. Scanners probe OWA, ECP, AutoDiscover, and related endpoints. Exploited by nation-state actors including HAFNIUM prior to patch release.

Probes F5 BIG-IP /mgmt/tm/util/bash endpoint associated with iControl REST authentication bypass RCE vulnerabilities (CVE-2022-1388, CVE-2023-46747).

GeoServer allows evaluation of property name expressions as XPath via OGC filter evaluation in GeoTools. An unauthenticated attacker can execute arbitrary code on the server. Affects GeoServer prior to 2.23.6, 2.24.4, and 2.25.2.

Unauthenticated command injection in Hikvision IP cameras via the /SDK/webLanguage ISAPI endpoint. Affects firmware versions prior to various per-model patches. Actively exploited in the wild for botnet recruitment (Moobot, Mirai variants).

Critical SQL injection in Progress MoveIT Transfer allowing unauthenticated attackers to escalate privileges and execute arbitrary code. Most exploited vulnerability of 2023, used by the CL0P ransomware group for mass data exfiltration across hundreds of organisations. Probed via the moveitisapi DLL endpoint with custom Go-based tooling, indicating directed targeting rather than automated mass scanning.

Authentication bypass in OpenWrt LuCI web interface via the ;stok=/locale path segment, which circumvents session token validation. Affected versions allow unauthenticated attackers to execute OS commands through the router admin panel. Primarily targets home routers and small office equipment — a key target for IoT botnet recruitment (Mirai lineage).

POST requests using URL-encoded PHP ini directives (-d allow_url_include=1 -d auto_prepend_file=php://input) to achieve remote file inclusion and code execution via php://input stream.

Exploits PHP include via 'lang' query param: first traverses to /tmp/index1 to check write access, then uses pearcmd config-create to drop a PHP webshell. Combines path traversal with pearcmd RFI for full RCE.

POST requests with URL-encoded -d flags injecting allow_url_include=1 and auto_prepend_file=php://input to abuse PHP-CGI argument parsing, enabling remote code execution via php://input body. Targets php-cgi on Windows and generic PHP endpoints.

PHPUnit ships an eval-stdin.php file that evaluates arbitrary PHP code from the request body. When the vendor/ directory is web-accessible (a common misconfiguration in older deployments), this enables unauthenticated RCE. Attackers probe multiple framework-specific and versioned paths.

Broad scan for PHPUnit CVE-2017-9841 eval-stdin.php across dozens of common subdirectory prefixes (vendor, lib, cms, demo, test, admin, blog, ws, zend, etc.) to find exposed dev dependencies.

Exploits command injection in router CGI endpoints (ping.cgi, login.cgi) to wget and execute a botnet binary from 37.48.254.120. Targets embedded Linux devices via shell metacharacter injection.

Command injection via ping.cgi and login.cgi on home/SOHO routers to wget and execute a botnet binary from 37.48.254.120. Targets ARM devices via /tmp/arm7 payload. Classic Mirai-style dropper.

Attempts to retrieve SSH private keys (/.ssh/id_rsa) and authorized_keys (/.ssh/authorized_keys) via misconfigured web roots to gain persistent server access.

Coordinated scanning campaign targeting SonicWall SSL-VPN infrastructure. Observed paths: /api/sonicos/*, /sslvpnLogin.html, /sonicui/*. Traffic originates from US-based IPs in a clustered pattern suggesting automated tooling or botnet coordination. SonicWall CVEs (CVE-2024-53704 and related) actively exploited in the wild.

Remote code execution via ThinkPHP's invokefunction route, which exposes call_user_func_array to unauthenticated requests. Affects ThinkPHP 5.x. Widely exploited by botnets for webshell deployment.

Distributed botnet identified by the libredtail-http User-Agent sweeping a wide array of PHPUnit eval-stdin.php paths across framework-specific and generic directories. Secondary payloads include PHP ini injection, ThinkPHP invokefunction RCE, PEAR command injection, and Docker REST API enumeration — indicating a full-cycle exploitation toolkit. Observed across 10+ countries simultaneously, consistent with coordinated botnet operation.

Scans for editor backup and example variants of .env files (.env~, .env.swp, .env.sample, .env.example, .env.staging) left behind by developers, often containing real production secrets despite the naming convention.

Mass scanning for exposed .env files across 20+ known path variants targeting all major frameworks (Laravel, Symfony, Next.js, Nuxt, Django, Rails, Node.js). Exfiltrates database credentials, API keys, OAuth tokens, and cloud provider secrets. Some actors spoof Googlebot/Bingbot User-Agents to bypass WAF bot allowlists. Observed from FR, GB, US, IR with notable Iranian presence.

Systematic enumeration of .env file variants including environment-specific suffixes (.env.prod, .env.staging, .env.ci, .env.secret, .env.qa, etc.) and subdirectory locations to harvest credentials and configuration.

Enumeration of Alibaba Cloud (alicloud) and Aliyun credential/configuration files (js/json/yaml variants) commonly used to store AccessKey IDs and secrets for Chinese cloud infrastructure.

Scans for exposed Alibaba Druid database connection pool monitoring console (/druid/index.html) which can leak SQL queries, credentials, and session tokens.

Enumerates Apache access control files /.htpasswd and /.htaccess to harvest hashed credentials or discover protected paths and rewrite rules.

Scans for Apache OFBiz control endpoints (accounting/control/main, ecommerce/control/main) commonly targeted for authentication bypass and RCE vulnerabilities (e.g., CVE-2023-49070, CVE-2023-51467).

Scanning for exposed Apache Solr admin endpoints (/solr/admin/cores, /solr/admin/info/system) to enumerate cores, gather system info, and potentially exploit Solr RCE vulnerabilities.

Exploits default credentials and command injection in BOA-based fiber router admin panels (/boaform/admin/formLogin) commonly used by Netlink/GPON ONT devices. Associated with IoT botnet recruitment.

Probes for exposed SQL database dumps (/backup.sql) commonly left in web roots after deployments, resulting in full database disclosure.

Scans for exposed Django settings.py file which contains SECRET_KEY, database credentials, and other sensitive configuration.

Mass scanning for .env files in a wide variety of subdirectory paths including /public/, /core/, /apps/, /production/, /src/, /app/config/, /crm/, /local/, /old/, /shop/, /docker/, /cgi-bin/, /database/, /new/, /www/, /dashboard/, /library/, /_static/, and /.c9/.

Probes for SSL-VPN / SSTP endpoints including Fortinet /remote/login and Microsoft SSTP /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ tunnel path. Used to identify VPN gateways for credential attacks and CVE exploitation.

Specialised scanner targeting FreePBX/Asterisk VoIP installations via the FreePBX-Scanner/1.0 User-Agent. Probes admin config panels and recordings interfaces. Successful exploitation enables toll fraud (IRSF), call interception, and lateral movement into the corporate network. Actor demonstrates VoIP-specific tooling indicating specialised targeting rather than generic scanning.

Scans for exposed .git/config files under common subdirectories (admin, api, app, backup, cms, etc.) and via path traversal variants (assets../, media../, static../). Targets source code and credential leakage.

Requests /.git-credentials, a file where git stores plaintext HTTPS credentials. Successful retrieval yields repository access tokens and passwords.

Probes /HNAP1 endpoint present on D-Link and other SOHO routers. Multiple HNAP CVEs allow authentication bypass and RCE. Commonly targeted by botnets for device recruitment.

Probing for exposed infrastructure configuration files at the web root: Docker Compose files, Dockerfiles, Terraform state, Pipfiles, and deployment manifests. These files frequently contain hardcoded secrets, service credentials, internal hostnames, and cloud provider configuration. Primary actor observed using wget/curl from GB infrastructure, suggesting automated harvesting pipeline.

Scans for legacy /hudson Jenkins/Hudson CI server paths. Exposed Jenkins instances frequently allow unauthenticated script console RCE, build pipeline tampering, and credential extraction.

Scans for /configuration.php, the Joomla CMS configuration file containing database credentials, secret keys, and SMTP credentials in plaintext PHP variables.

Probes /api/v1/secrets to access Kubernetes cluster secrets via an exposed API server. A successful unauthenticated request reveals all namespace secrets including credentials and tokens.

Attempts to read Kubernetes serviceaccount tokens, CA certificates and namespace files from container runtime secret mount paths. Also targets Istio service mesh credentials, kubeconfig files and ArgoCD temporary tokens. Indicates scanners targeting containerized workloads running with exposed management interfaces.

Targeting the Magento local.xml configuration file, which contains database hostname, credentials, encryption keys, and admin path configuration in plaintext XML. A web-accessible app/etc/ directory — common in misconfigured Magento 1.x deployments — exposes full database access. Successful exfiltration enables account takeover, payment data theft, and skimmer injection.

Scans for backup variants of PHP configuration files such as config.php.bak and wp-config.php~ (editor swap/backup extensions) to disclose DB credentials and secrets.

Attempts to override PHP runtime configuration via query string parameters, enabling remote code execution through allow_url_include and auto_prepend_file directives pointing to php://input. Targets misconfigured PHP installations exposed directly.

When PHP is run in CGI mode, the pearcmd.php script can be invoked via query parameter injection (?+config-create+/&cmd=...). Attackers use the +config-create+ gadget to write PHP webshells to the filesystem. Common in Docker/container environments with default PHP-FPM CGI configurations.

Scans Pulse Secure / Ivanti Connect Secure VPN welcome page (/dana-na/auth/url_default/welcome.cgi) as recon for known VPN vulnerabilities (CVE-2019-11510, CVE-2023-46805, CVE-2024-21887).

Probes QNAP NAS /cgi-bin/authLogin.cgi endpoint, target of multiple QNAP vulnerabilities and ransomware campaigns (Qlocker, DeadBolt) for credential harvesting and RCE.

Scans for /config/database.yml, the Ruby on Rails database configuration file that typically contains plaintext DB credentials, host names, and connection strings.

Path traversal attempts targeting SSH host private keys (/etc/ssh/ssh_host_*_key) and SSL/TLS private key directories. Exfiltration of SSH host keys enables person-in-the-middle attacks against all SSH sessions to the server. SSL private key theft enables passive TLS decryption and certificate impersonation. Observed primarily from GB infrastructure consistent with automated credential harvesting operations.

Scans for exposed /.bash_history files which can leak command-line activity including credentials, SSH targets, API tokens, and admin operations entered by server operators.

Probes for exposed Spring Boot Actuator endpoints (/actuator/env, /actuator/health) which can leak environment variables, credentials, and enable RCE via misconfigured property sources.

Spring Boot Actuator endpoints expose application internals (environment variables, config, heap dumps, route mappings). The /actuator/env endpoint allows property overrides in some versions, leading to RCE via spring.datasource or logging properties. /actuator/gateway/routes can be abused in Spring Cloud Gateway CVE-2022-22947 (SPEL injection, CVSS 10.0). /actuator/heapdump leaks credentials from memory.

Targets exposed Streamlit application secret files (.streamlit/secrets.toml) which commonly contain API keys, database credentials, and cloud service tokens.

Probes for Apache Struts2 login action endpoint, commonly targeted for OGNL injection RCE vulnerabilities (S2-045, S2-057, etc).

Scanning for exposed Symfony web profiler at /_profiler/phpinfo. Exposed profiler can leak environment variables, credentials, and internal app details, and may allow RCE in dev mode.

Scans for /frontend_dev.php, the Symfony development front controller which exposes the web profiler, debug toolbar, and verbose error pages potentially leaking source code, configuration, and credentials.

Requests /app/config/parameters.yml, the Symfony configuration file containing database credentials, mailer settings, and application secrets.

Probes /goform/formJsonAjaxReq endpoint present on Tenda and similar SOHO routers, associated with multiple command-injection and stack overflow CVEs targeted by Mirai-style botnets.

ThinkPHP invokefunction RCE probe using md5('Hello') as a canary to confirm code execution. Targets both root index.php and /public/index.php. Widely distributed across many countries.

Path traversal attempts using URL-encoded slashes (%2F) to bypass filters and reach /etc/passwd, commonly used against various web app vulnerabilities.

Probes /developmentserver/metadatauploader, associated with VMware vCenter Server vulnerabilities. May relate to CVE-2021-22005 or similar unauthenticated file upload endpoints.

Scans for backup variants of wp-config.php (e.g. wp-config.php.bak, wp-config.php.old) which often contain WordPress database credentials and secret keys in plaintext.

XDebug is a PHP debugging extension that listens for remote connections when enabled. Attackers trigger a debug session by appending XDEBUG_SESSION_START=phpstorm (or similar) to any request. If the server has XDebug running in remote mode and the firewall is open, arbitrary code execution is possible via the debug protocol.

Probes Yii framework debug panel (/debug/default/view?panel=config) which exposes application config, environment, and may allow RCE via Gii/debug module misconfigurations.

Scans for exposed secrets.json files used by various Node.js, .NET, and Python applications to store API keys, database credentials, and OAuth client secrets.

Scans for rarely-targeted .env variants: .env.testing.local, .env.uat, and .envrc. These may contain environment-specific credentials not covered by standard .env harvesting tools.

Generic campaign probing for path traversal to /etc/passwd — the canonical Unix credential file. Attempts use raw paths, URL-encoded variants (%2f, %2F), double-encoded sequences, and mixed-case encoding. Usually automated scanners checking for traversal vulnerability presence.

Scanning for exposed AI/LLM API endpoints including Anthropic and OpenAI-compatible /v1/models routes. Likely targeting improperly secured self-hosted LLM inference servers for abuse or key theft.

Probes AVTECH IP camera /evox/about endpoint, associated with multiple unauthenticated info disclosure and command injection vulnerabilities used by Mirai variants.

Fingerprints Atlassian Crowd installations via /crowd/about.jsp to identify version, likely precursor to CVE-2019-11580 pdkinstall RCE exploitation.

Scans for Cisco ASA SSL VPN WebVPN logon page (/+CSCOE+/logon.html), reconnaissance for known Cisco ASA vulnerabilities (CVE-2020-3452, CVE-2018-0101, etc.).

POST requests to /dns-query endpoint probing for exposed DNS-over-HTTPS resolvers. Low volume currently but consistent — likely early reconnaissance phase. DoH abuse allows DNS tunneling and C2 traffic obfuscation bypassing traditional DNS monitoring.

Probing for exposed docker-compose production configuration files (docker-compose.prod.yml) to harvest service topology, credentials, image names, and environment variables.

Probes for /webui/ paths used by many appliance and router management interfaces (Citrix ADC, Synology, various IoT). Often a precursor to credential brute-force or known CVE exploitation of the underlying device.

Probes for generic PHP debug/test files (php.php, debug.php) that developers commonly leave behind. These often expose phpinfo() output, environment variables, or arbitrary command execution shells.

Scanners probe for exposed .git/config files to extract repository metadata, remote URLs, branch names, and credentials stored in the git config. A web-accessible .git/ directory allows full source code reconstruction. Commonly found on misconfigured deployments that copy the repo root to the web root.

Scans for exposed .gitlab-ci.yml files which may reveal CI/CD pipeline configuration, deployment scripts, internal hostnames, or secret variable references useful for further reconnaissance.

Probes for exposed GraphQL endpoints to enable introspection-based schema discovery, potentially exposing sensitive queries/mutations.

Probes for exposed Microsoft SQL Server Reporting Services (/ReportServer), target for CVE-2020-0618 and credential brute-force.

POST requests probing Next.js internal endpoints /_next and /_next/server. May be attempting to exploit server-side rendering endpoints or discover internal API routes for further attack.

Scans for exposed Node.js project files (package.json, yarn.lock, .npmrc) which may leak dependency information, internal registry credentials, or authentication tokens used in CI/CD pipelines.

POST requests to /onvif/device_service, a SOAP endpoint exposed by ONVIF-compliant IP cameras and NVRs. Used to enumerate camera devices, fingerprint firmware, and target known ONVIF authentication bypass / RCE vulnerabilities.

CONNECT method requests to google.com:443 used to test whether the honeypot is functioning as an open HTTP proxy. Common technique to find misconfigured proxy servers for abuse.

HTTP CONNECT requests to external hosts (api.ipify.org, www.google.com, arbitrary IPs) used by abuse actors to test whether the server is functioning as an open forward proxy for traffic laundering or scraping.

Probes root with ?phpinfo=1 query parameter attempting to trigger phpinfo() output via vulnerable scripts that echo phpinfo when query flag is present.

Targets Red Lion industrial controllers/HMI portal endpoint (/portal/redlion), reconnaissance against ICS/SCADA equipment.

Probes SharePoint-specific /_layouts/15/ paths including start.aspx and spinstall0.aspx to fingerprint SharePoint installations and identify potential exploitation targets.

POST requests to /sdk, used by VMware vSphere/vCenter SOAP API and also Dahua IP camera SDK endpoints. Scanners probe this to fingerprint and exploit authentication or deserialization flaws.

Probes for exposed WordPress backup directories (/wp-content/backup, /wp-content/backups) commonly created by backup plugins, which may expose database dumps and credentials.

Scans for exposed /config.js files commonly used by JavaScript SPAs and Node.js applications to store API endpoints, keys, and feature flags. May leak backend URLs and embedded credentials.

Probing for exposed config.json files at webroot which may contain database credentials, API keys, or application secrets. Common in misconfigured Node.js, static site generators, and CMS deployments.

Scans for exposed phpMyAdmin installations for credential brute-force and known phpMyAdmin RCE/SQLi vulnerabilities.

CensysInspect internet-wide scanner probing with randomised path strings to detect honeypots and content-addressable servers. A server that returns identical responses to arbitrary random paths is flagged as a honeypot or catch-all. Also probes /proc/self/cgroup to detect containerised environments before committing further exploitation attempts — indicating actor awareness of sandbox and honeypot detection techniques.

Sends HTTP/2 upgrade preface (PRI * HTTP/2.0) to HTTP/1.1 listeners to fingerprint server HTTP/2 support or exploit misconfigurations in protocol negotiation.

Requests /_vti_pvt/service.cnf, a FrontPage Server Extensions metadata file. Can reveal server configuration and software versions. Indicates scanning for legacy IIS/FrontPage installations.

Scans for exposed PHP diagnostic pages (phpinfo.php, info.php, test.php, _profiler/phpinfo) to harvest PHP configuration, loaded modules, environment variables, and server paths.