cPanel Exploit Attempt Uncovers Alfa Team Shell and AnonSec LPE Chain

One request named the recovered payload

Between 14:30 and 14:41 UTC on the 18th of September 2026, an automated exploit sequence targeted cPanel/WHM on TCP/2087 from 203[.]147[.]133[.]21 (AS38235, Cambodia). Two minutes and 34 seconds into the interaction, the source attempted to execute:

The requested object is a 1.3 MB Base64-wrapped ALFA TEaM Shell 4.1 Tesla body with command execution, file manipulation, database extraction, credential harvesting, CMS backdoors, and mass defacement features.

One repository linked four web-shell families

The hosting GitHub repository (github[.]com/Kamp4ng/cilako) contains ten staging files spanning Alfa Team, AnonSec/Anon7, TEAM KJ, and NEXUS v22.0 shells, alongside loaders and a WordPress administrative account creator.

One loader (anore.txt) fetches an AnonSec Shell from Cloudflare R2 (hxxps://pub-b610cc40e6f94f0c89cbcf3d40b59864[.]r2[.]dev/anore[.]txt) that can retrieve local privilege escalation scripts and run the Linux Exploit Suggester.

The activity reflects an automated scanner testing cPanel command injection using a multi-family PHP toolkit staged on public cloud services.

Defender-visible markers

1. Search cPanel and web logs for /json-api/scripts/exec, alfa-putih, and ok.php.
2. Deploy the included Suricata rule (SID 1000638003) on reverse proxies or inspection points with plaintext HTTP visibility for cPanel management ports.
3. Scan web roots and evidence archives using the included Alfa Team YARA rule.
4. Block external access to the Kamp4ng/cilako repository and the Cloudflare R2 staging endpoint.