SOCRadar Finds PHP2Shell Tools Added After Japanese Real Estate Extortion Campaign
Summary
SOCRadar found an exposed operator server containing evidence of an October 2026 extortion campaign affecting nearly 20 Japanese sites and stolen customer data. PHP2Shell tools appeared after the campaign; the files showed no successful live exploitation.
Key points
- An exposed server held more than 3,800 files, including web-shell and deployment scripts, beacon logs, ransom pages, stolen data, and PHP2Shell tooling.
- Beacon logs and scripts indicate the operator used a stored SSH key and a reused database password to move from an initial Japanese real estate victim to nearly 20 other sites between October 9 and 11, 2026.
- The PHP2Shell package and related scripts were dated October 21, after the extortion wave. The files showed no successful exploitation of a live target and did not link PHP2Shell to the earlier intrusions.
- The initial victim’s recovered member export contained 16,061 records, including plaintext passwords and personal, financial, and property-search details.
- On October 22–23, the operator retrieved five SQL Server backups, 663 FoxPro database files, and 730 emails from a Taiwanese company’s Windows server.
- The article recommends patching CVE-2026-109618 and CVE-2026-109619, removing web shells and persistence, rotating shared credentials, and resetting affected customer passwords.
Article Details
- Attack Vectors
- The initial access method for the Japanese real estate websites is not established; the article says the October 9–11 extortion wave did not rely on PHP2Shell.
- After obtaining web-shell access to the initial victim, the operator placed PHP web shells in upload directories, injected a beacon into site configuration, and installed a cron job that repeatedly rewrote .htaccess.
- The operator used a stored SSH private key and a database password reused across sites to access accounts on shared hosting and query other victim sites.
- The operator stole customer records and business data, defaced websites with ransom notices, and used scripts to send bulk messages to customers.
- PHP2Shell tooling was added to the staging server on October 21, after the extortion wave. The files show preparation and probing, but no successful PHP2Shell exploitation against a live target.
- Defensive Notes
- Patch PHP to releases that fix CVE-2026-109618 and CVE-2026-109619, and review vendor guidance on session upload progress settings.
- Remove web shells and unauthorized cron entries; restore clean website pages and data.
- Rotate SSH keys, database passwords, and FTP passwords on affected accounts, especially credentials reused across sites.
- Reset affected customer passwords, use hashed password storage, and notify affected customers.
- Keep backups outside the hosting account and review authorized_keys files, SSH login history, crontabs, and web-server logs.
- Block traffic to and from 96.126.130.81 at the network and hosting level.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 96[.]126[.]130[.]81 | Attacker staging server hosting working files and PHP2Shell tooling; also used for beacon callbacks and a PowerShell C2. |
MITRE ATT&CK
T1021.004 · SSHThe operator used SSH to access multiple accounts on the shared hosting provider with a stored private key.T1053.003 · CronA cron entry rewrote a victim site's .htaccess file every minute, undoing the owner's lockout changes.T1059.001 · PowerShellA PowerShell agent on the staging server's separate C2 polled for commands every 30 seconds and returned results.T1071.001 · Web ProtocolsVictim-site beacons called back to 96.126.130.81 using HTTP-style URI paths, and the separate C2 agent polled the server for commands.T1078 · Valid AccountsThe operator used existing hosting accounts and reused credentials to access victim sites and accounts.T1114 · Email CollectionThe operator obtained 730 emails from a Taiwanese company mailbox through access to its Windows server.T1190 · Exploit Public-Facing ApplicationThe server held probe and repeated-exploitation scripts for PHP2Shell, and the article describes log patterns associated with PHP2Shell exploitation attempts; no successful live-target exploitation was confirmed.T1491.002 · External DefacementScripts overwrote victim websites' public homepages and admin panels with maintenance notices and ransom messages.T1505.003 · Web ShellThe operator placed PHP web shells under victim website upload directories and accessed a Taiwanese company's Windows server through a web shell.T1552.004 · Private KeysAn SSH private key stored on the staging server was used to log in to other accounts on the shared hosting provider.
CVE
Threat Actors
Products
Tools
Countries
Hong KongAfter the Japanese wave, the operator compiled 3,913 Hong Kong and Taiwan IP ranges and ran mass scans against them on October 21, 2026, the same day the PHP2Shell tooling arrived, and the separate “finance line” C2JapanThe haul spans Japan and Taiwan and covers customer records, internal databases and business email.TaiwanThe haul spans Japan and Taiwan and covers customer records, internal databases and business email.