Censys Investigates cPanel Surge Amid Mirai and “.sorry” Ransomware Activity
Summary
Censys reports that cPanel/WHM hosts accounted for nearly 80% of newly malicious hosts on May 1, alongside Mirai deployments and a possible ransomware campaign marked by exposed files renamed “.sorry”; the campaign’s full scope remains unclear.
Key points
- CVE-2026-41940 was disclosed on April 29, 2026, as a critical pre-authentication bypass affecting cPanel/WHM login flows.
- On May 1, cPanel/WHM hosts made up nearly 80% of the net increase in hosts classified as malicious by Censys using GreyNoise signals.
- Censys analyzed a Mirai variant sample and found no cPanel attack module in the binary, suggesting the malware may be deployed after initial compromise; the report describes this as an inference.
- Censys observed 8,859 public directories with files renamed using the “.sorry” extension; 7,135 of those hosts were identified as running cPanel or WHM.
- The “.sorry” pattern and ransom note are consistent with ransomware activity, but Censys says the event is still developing and its full scope is unclear.
- The observed malicious cPanel hosts were concentrated among VPS and cloud providers, including DigitalOcean, Contabo, and OVH.
Article Details
- Attack Vectors
- CVE-2026-41940 is described as a pre-authentication bypass in cPanel/WHM login flows that may allow remote unauthenticated access.
- Censys observed activity classified as Telnet brute force, with patterns consistent with Mirai.
- A post on X, described as unverified, claimed the vulnerability was being used to deploy the Mirai variant nuclear.x86. Analysis of the referenced binary found no cPanel attack module, suggesting deployment after initial compromise.
- A separate campaign was consistent with ransomware activity: files on exposed directories were encrypted and renamed with the “.sorry” suffix.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 95bcc0a2bb0fff25a2770010406cd0964fd4b3033ed8bae181518f7c8b69d324 | SHA256 of the binary referenced in an unverified post as the nuclear.x86 Mirai variant; Censys analyzed it and found no cPanel attack module. |
MITRE ATT&CK
T1110.001 · Password GuessingCensys observed malicious activity classified as Telnet brute force, with patterns consistent with Mirai.T1190 · Exploit Public-Facing ApplicationThe article describes CVE-2026-41940 as a remote, unauthenticated pre-authentication bypass affecting cPanel/WHM login flows.
CVE
Malware
Hidden-TearThe “.sorry” file extension has previously been associated with the Hidden-Tear variant of the Sorry Ransomware.MiraiAnalysis indicates two active campaigns—post-compromise Mirai deployments and a large-scale file-encrypting campaign appending “.sorry” to files—heavily targeting cPanel systems.nuclear.x86We then identified an unverified post on X (Twitter) from a user (@social5h3ll) claiming that the cPanel vulnerability was being used to deploy a Mirai variant named nuclear.x86.Sorry RansomwareThe “.sorry” file extension has previously been associated with the Hidden-Tear variant of the Sorry Ransomware.
Vendors
Products
cPanelA critical pre-authentication bypass, CVE-2026-41940, was disclosed in cPanel/WHM and coincided with a sharp spike in hosts classified as malicious.WHMA critical pre-authentication bypass, CVE-2026-41940, was disclosed in cPanel/WHM and coincided with a sharp spike in hosts classified as malicious.