In a recent revelation, cybersecurity firm Dream has identified a China-associated threat group exploiting vulnerabilities in PHP2Shell to gain unauthorized access to firewalls. This initiative involves deploying webshells to maintain persistent access to compromised systems.
Exploitation of PHP and Linux Kernel Flaws
The attackers have ingeniously combined exploits for two PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, with a Linux kernel privilege escalation flaw, CVE-2026-46300, known as Fragnesia. This chain of exploits has been instrumental in their efforts to penetrate targeted systems.
Using the Chinese asset search engine FOFA, the hackers pinpointed 19,000 internet-exposed firewalls from a specific vendor. On October 23-24, they successfully exploited 25 of these devices, as reported by Dream.
Targets and Attack Methodology
After identifying potential targets, the attackers filtered servers located in the United States, Japan, Taiwan, and South Korea, focusing on those running the latest PHP versions. This narrowed down their list to approximately 240 possible targets.
Employing an automated tool, the attackers unleashed the full PHP2Shell-Fragnesia exploit sequence, successfully installing a PHP root webshell on 24 devices to secure persistent access. While 22 firewalls showed no further post-exploitation activity, two in the U.S. government-affiliated environment were compromised further.
Detailed Analysis of the Attack
The initial attack on October 23 led to a server crash. A subsequent attack wave on October 24 managed to bypass defenses successfully. The hackers monitored the initial firewall with 240 probes over two hours, but without success. The secondary firewall, closely linked to the target organization through its certificate data, experienced a timeout during the initial attack batch.
To maintain their foothold, the attackers initiated a reverse SSH tunnel, enabling them to target an internal firewall management server with the same exploit chain. This granted them access to critical configurations, credentials, and settings across all firewalls managed by the organization.
Further exploitation involved decrypting LDAP service account passwords, listing domain users and groups, conducting password spraying attacks, and attempting to establish backdoor accounts in Active Directory.
Strategic Implications and Attribution
While the specific threat actor remains unidentified, Dream attributes the operation to a Chinese-linked entity, suggesting a nation-state level cyber operation. The target regions, namely the U.S., Japan, Taiwan, and South Korea, are considered key strategic adversaries by Chinese state-aligned cyber operatives in the Pacific region.
This development underscores the ongoing cyber threat landscape and the need for heightened cybersecurity measures. Organizations are urged to patch identified vulnerabilities promptly and enhance their defensive strategies against such sophisticated attacks.
