Mr_Rot13 Linked to Active Exploitation of cPanel CVE-2026-41940
Summary
QiAnXin XLab links Mr_Rot13 to active exploitation of cPanel CVE-2026-41940. The reported chain uses SSH persistence, a web shell, credential theft, and the cross-platform Filemanager backdoor.
Key points
- XLab reports that multiple threat actors have exploited cPanel and WHM CVE-2026-41940 since its public disclosure.
- More than 2,000 attacker source IPs were observed targeting the vulnerability, according to XLab.
- The analyzed chain downloads a Go-based infector that adds an SSH key for persistent access and installs a PHP web shell.
- The web shell injects JavaScript into a customized login page to steal credentials.
- The infector can collect host data, including SSH information, database passwords, and shell history, and send it to a Telegram group.
- The Filemanager backdoor reportedly supports file management, remote command execution, and shell access across Windows, macOS, and Linux.
- XLab links the operation to Mr_Rot13 in part through a C2 domain also found in a PHP backdoor uploaded to VirusTotal in 2022.
Article Details
- Attack Vectors
- The reported campaign exploits CVE-2026-41940 in cPanel and WHM, which can enable authentication bypass and elevated control of the control panel.
- A shell script uses wget or curl to download a Go-based infector that installs an SSH public key for persistent access and drops a PHP web shell.
- The web shell injects JavaScript that serves a customized login page to steal credentials.
- A separate shell script downloaded from wpsock[.]com delivers the Filemanager backdoor, which supports file management, remote command execution, and shell functionality.
- The infector collects bash history, SSH data, device information, database passwords, and cPanel virtual aliases, then sends the data to a Telegram group.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cp[.]dene[.]de[.]com | Reported remote server used by the shell script to download the Go-based infector. |
| DOMAIN | wpsock[.]com | Reported malicious domain hosting the shell script that delivers the Filemanager backdoor. |
| DOMAIN | wrned[.]com | Attacker-controlled domain used to receive stolen login credentials. |
MITRE ATT&CK
T1005 · Data from Local SystemThe infector collects local bash history, SSH data, device information, database passwords, and cPanel virtual aliases.T1056.003 · Web Portal CaptureThe customized login page is used to steal users’ login credentials.T1059.004 · Unix ShellThe infection sequence uses shell scripts to download and deploy payloads.T1059.007 · JavaScriptThe web shell injects JavaScript to serve a customized login page.T1098.004 · SSH Authorized KeysThe infector implants an SSH public key to maintain persistent access.T1105 · Ingress Tool TransferShell scripts use wget or curl to download the Go-based infector and Filemanager delivery script.T1132.001 · Standard EncodingThe article says stolen credentials sent to wrned[.]com are encoded using ROT13.T1190 · Exploit Public-Facing ApplicationThe campaign exploits CVE-2026-41940 in internet-facing cPanel and WHM systems.T1505.003 · Web ShellThe attack drops a PHP web shell that supports file transfers and remote command execution.T1567.004 · Exfiltration Over WebhookThe collected host information is sent to a Telegram group.
CVE
Threat Actors
Malware
Products
Countries
Brazil“These IPs are distributed across multiple regions globally, primarily originating from Germany, the United States, Brazil, the Netherlands, and other regions.”Germany“These IPs are distributed across multiple regions globally, primarily originating from Germany, the United States, Brazil, the Netherlands, and other regions.”Netherlands“These IPs are distributed across multiple regions globally, primarily originating from Germany, the United States, Brazil, the Netherlands, and other regions.”United States“These IPs are distributed across multiple regions globally, primarily originating from Germany, the United States, Brazil, the Netherlands, and other regions.”