cyber.hendryadrian.com
Threat Research · hunt.io

Exposed Servers Reveal Scanning and BlueShell Tools Targeting Asian Organizations

· Original article ↗

Summary

Hunt researchers found exposed servers containing SQLMap and Nmap scans, reconnaissance tools, scripts, and files linked to the BlueShell backdoor, with activity targeting government and institutional organizations in Taiwan and elsewhere in Asia.

Key points

  • An exposed Taiwan-hosted server contained SQLMap files targeting a Taiwanese government website and Nmap scan results for a data-center network.
  • Two Go binaries in the directory accessed a certificate matching the open-source BlueShell backdoor.
  • Bash scripts checked network connectivity and detected CPU types before applying corresponding MSR values.
  • Researchers found other exposed directories containing tools such as Acunetix, Brute Ratel C4, and subdomain enumerators.
  • Directory contents showed scanning and reconnaissance targets including government agencies, a university hospital, and other institutions across Asia and beyond.
  • The researchers describe continuously monitoring exposed directories as a way to uncover threat activity.

Article Details

Attack Vectors
  • Exposed open directories made files, scripts, and scan results publicly accessible.
  • SQLMap was used to scan a Taiwanese government website and other listed targets for vulnerabilities.
  • Nmap was used to scan a /26 network associated with a Taiwanese data center for open ports.
  • The directories contained tools and results for subdomain enumeration and vulnerability scanning against government and institutional targets.
Defensive Notes
  • Continuously monitor exposed open directories and misconfigured servers for attacker tools and scan results.
  • Review exposed files and scripts for evidence of reconnaissance and malicious infrastructure.

MITRE ATT&CK

T1046 · Network Service DiscoveryNmap was used to scan a /26 network associated with a Taiwanese data center for open ports.T1595.002 · Vulnerability ScanningSQLMap was used to scan a Taiwanese government website and other targets for vulnerabilities.

Malware

BlueShellcenter. The server's administrator utilized open-source tools such as Nmap, SQLMap, and the backdoor BlueShell to conduct their activities. The directory was only briefly available before the actor likely realized

Tools

Acunetixis IP address 35.229.211_35, which leverages various open-source tools such as SecurityTrails API, Acunetix, and ChatGPT. In Figure 8, you'll find an excerpt from a Python script named chatgpt.py, designed toAfrogtargeting Taiwan and ParaguayWithin the same directory is a folder named "af/" containing the program Afrog, a vulnerability scanning tool. This subfolder also included a file named taef.org.txt. In this context,Brute Ratel C4for taef_org.Lastly, we discovered IP 45.8.146_29, which hosted several offensive tools, including Brute Ratel C4, JSFinder, ProxyShell, and Earthworm. Among the various folders was "OneForAll," a subdomainChatGPT35.229.211_35, which leverages various open-source tools such as SecurityTrails API, Acunetix, and ChatGPT. In Figure 8, you'll find an excerpt from a Python script named chatgpt.py, designed to automate web pageEarthworm45.8.146_29, which hosted several offensive tools, including Brute Ratel C4, JSFinder, ProxyShell, and Earthworm. Among the various folders was "OneForAll," a subdomain enumeration tool. This folder contained scanJSFinderwe discovered IP 45.8.146_29, which hosted several offensive tools, including Brute Ratel C4, JSFinder, ProxyShell, and Earthworm. Among the various folders was "OneForAll," a subdomain enumeration tool.NmapFreeway Bureau and a local data center. The server's administrator utilized open-source tools such as Nmap, SQLMap, and the backdoor BlueShell to conduct their activities. The directory was only briefly availableOneForAlltools, including Brute Ratel C4, JSFinder, ProxyShell, and Earthworm. Among the various folders was "OneForAll," a subdomain enumeration tool. This folder contained scan results targeting the National TaiwanProxyShellwe discovered IP 45.8.146_29, which hosted several offensive tools, including Brute Ratel C4, JSFinder, ProxyShell, and Earthworm. Among the various folders was "OneForAll," a subdomain enumeration tool. This folderSecurityTrails APIOne example is IP address 35.229.211_35, which leverages various open-source tools such as SecurityTrails API, Acunetix, and ChatGPT. In Figure 8, you'll find an excerpt from a Python script named chatgpt.py, designedsqlmapBureau and a local data center. The server's administrator utilized open-source tools such as Nmap, SQLMap, and the backdoor BlueShell to conduct their activities. The directory was only briefly available before

Countries

CambodiaIndiaIndonesiaJapanof Python ChatGPT scriptSimilar to our initial discovery, the IP address 202.182.105_104, located in Japan and hosted on The Constant Company network, contained a .sqlmap folder. This folder included scan resultsParaguayAlthough not shown in Figure 9, the folder also contained output targeting Paraguay's Ministry of Foreign Affairs.TaiwanHunt researchers identified a publicly accessible web server at IP address 103.98.73_189:8080, located in Taiwan. The server's HTTP headers (SimpleHTTP/0.6 Python/3.8.2) suggested it was running a Python-based webThailand

Industries

Data centersEducationGovernmentHunt users) and examine a history of similarly misconfigured infrastructure targeting various Taiwanese government agencies over the past year.HealthcareRailways

Related Articles