7 minhigh
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
A determined attacker compromised a shared recreation management platform by uploading ASPX webshells via member accounts, stealing payment card data and deploying browser-based C2 through trojanized jQuery files. The attacker registered member accounts on a multi-tenant IIS platform and abused file upload functionality to deploy ASPX webshells across three web servers. They extracted SQL credentials from web.config files, queried databases for cardholder data, and read Fortis payment webhook logs containing CVVs and card numbers. In the final stage, they trojanized a jQuery file to inject browser-based WebRTC C2 clients via Cloudflare Workers domains.
Sens:■ Immediate
IOCs20
9file path6sha2563url2domain
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block network egress to chat.ririmochii.workers.dev and fk.bubuneeko.workers.dev
- Quarantine and rebuild compromised web servers from known-good images
- Rotate all SQL credentials and API keys exposed in web.config files
- Audit all ASPX files in upload directories and non-standard web paths
Key Takeaways
- Attacker spent 6 hours on brute-force and IIS tilde enumeration before succeeding via account registration and file upload.
- 14 files uploaded to /documents/MemberFiles/ including ASPX webshells and JPG/PDF extension execution tests.
- SQL credentials harvested from web.config files using findstr and PowerShell XML parsing.
- Webshells masqueraded as css_bundle.aspx, jquery.validate.min.aspx, and webresource.aspx across web directories.
- Final stage used AI-generated PowerShell scripts to trojanize jQuery and establish WebRTC/WebSocket C2.
Attack Chain
- Initial Access: Registered member account on platform, abused file upload to deploy ASPX webshells to /documents/MemberFiles/
- Discovery: Enumerated host info, IIS configuration, and filesystem across multiple drives for payment data
- Credential Access: Extracted SQL credentials from web.config files using findstr and PowerShell XML parsing
- Collection: Queried SQL databases for cardholder data; read Fortis webhook logs containing CVVs and card numbers
- Defense Evasion: Copied webshells with masqueraded names, timestomped files, deployed AI-generated planter scripts
- Command and Control: Trojanized jQuery file to inject browser-based WebRTC and WebSocket C2 via Cloudflare Workers
Affected Systems
- IIS web servers hosting multi-tenant recreation management platform
- ASP.NET web applications with file upload functionality
- Fortis payment webhook integrations
- MXMerchant payment modules
- SQL Server databases storing cardholder data
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | w3wp.exe spawning cmd.exe and powershell.exe is visible; timestomping and jQuery injection are harder to detect. |
| Network Visibility | Medium | C2 over HTTPS and WSS to Cloudflare Workers blends with legitimate traffic without SSL inspection. |
| Detection Difficulty | Moderate | Webshell process spawning is detectable; masquerading, timestomping, and browser injection add complexity. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| IIS worker process w3wp.exe spawning cmd.exe or powershell.exe with reconnaissance commands like whoami or systeminfo (T1059.003, T1082). | EDR process creation and command line logs | Execution | Low — w3wp.exe spawning shells is rare |
| findstr executed by w3wp.exe child processes searching for connectionString, password, CVV, or CardNumber in web directories (T1552.001, T1005). | EDR command line and file access logs | Collection | Low — targeted keyword searches are abnormal |
| ASPX files created in non-standard web directories with legitimate-sounding names like css_bundle.aspx or webresource.aspx (T1036.005, T1505.003). | File integrity monitoring and EDR file events | Persistence | Medium — legitimate deployments may create ASPX files |
| PowerShell modifying file timestamps using SetCreationTime, SetLastWriteTime, or SetLastAccessTime methods on web directory files (T1070.006). | PowerShell ScriptBlock logging and EDR file events | Defense Evasion | Low — timestamp manipulation is rarely legitimate |
Required Log Sources
- IIS W3SVC logs
- Windows Security Event logs
- PowerShell ScriptBlock logging (4104)
- Process creation events (4688)
- File integrity monitoring alerts
- EDR process telemetry
Key Behavioral Indicators
- w3wp.exe spawning cmd.exe with whoami, hostname, or systeminfo
- findstr searching for connectionString or CVV in web directories
- appcmd.exe list sites executed from cmd.exe spawned by w3wp.exe
- ASPX files created in css, images, or includes web directories
- PowerShell scripts with ccrtc naming pattern in C:\Windows\Temp
- Base64-encoded .ps1.b64 or .js.b64 files in C:\Windows\Temp
Control Gaps
- File upload validation allowing .aspx files in member upload directories
- No file integrity monitoring on web root directories
- SQL credentials stored in plaintext in web.config files
- No network egress filtering to Cloudflare Workers subdomains
- Web server returned to production before full remediation
False Positive Assessment
Low — w3wp.exe spawning cmd.exe with reconnaissance commands and findstr searching for card data keywords are highly specific to attacker activity.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict file upload to safe MIME types; block ASPX uploads in member directories
- Implement file integrity monitoring on all web root directories
- Encrypt or vault SQL connection strings instead of plaintext in web.config
- Deploy WAF rules to block WebDAV methods and IIS tilde enumeration
User Protection
- Isolate affected web servers from production until forensic review completes
- Force password resets for all member accounts on compromised tenants
- Notify payment card processors to monitor for fraudulent transactions
- Scan all web directories for masqueraded ASPX files with CSS or JS names
Security Awareness
- Train staff to report unexpected file uploads or account registrations on shared platforms
- Review incident response procedures for incomplete remediation scenarios
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping23 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Plain-Language Summary
An attacker broke into a parks and recreation management platform by creating user accounts and uploading malicious web files. They used these files to search for and steal payment card information from the platform's databases and payment processing logs. The attacker later modified legitimate website files to turn visitors' browsers into remote-controlled tools. Organizations using similar shared platforms should review file upload controls and monitor for unauthorized executable files in upload directories.
Additional IOCs
- Domains:
chat[.]ririmochii[.]workers[.]dev- Cloudflare Workers subdomain hosting second-stage payloadfk[.]bubuneeko[.]workers[.]dev- Cloudflare Workers subdomain for WebRTC and WebSocket C2
- File Paths:
C:\Windows\Temp\plant_ccrtc_mousewheel.ps1- Recursive filesystem scanner planter dropped on hostC:\Windows\Temp\plant_ccrtc_mousewheel.ps1.b64- Base64-encoded planter script staged on hostC:\Windows\Temp\plant_ccrtc_fast.ps1.ps1- Low-noise shallow scanner planter dropped on hostC:\Windows\Temp\plant_ccrtc_fast.ps1.ps1.b64- Base64-encoded fast planter staged on hostC:\Windows\Temp\ccrtc_sdk_init.js- Browser C2 agent JavaScript dropped on hostC:\Windows\Temp\ccrtc_sdk_init.js.b64- Base64-encoded browser C2 agent staged on hostE:\Content\info\includes\css_bundle.aspx- Masqueraded webshell copied to CSS includes directoryE:\Content\info\master\jquery.validate.min.aspx- Masqueraded webshell copied to master directoryE:\Content\management\includes\css_bundle.aspx- Masqueraded webshell in management includes directory
- Command Lines:
- Purpose: SQL database enumeration for cardholder data columns | Tools:
sqlcmd| Stage: Collection - Purpose: Search web.config for connection strings and passwords | Tools:
findstr| Stage: Credential Access |findstr /i /c:"connectionString" /c:"password" <path>\web.config - Purpose: Copy webshells across directories with masqueraded names | Tools:
cmd.exe,copy| Stage: Persistence |cmd /c if not exist "<dir>" mkdir "<dir>" & copy /y "<shell>" "<target>" - Purpose: Timestomp webshell files using reference file timestamps | Tools:
powershell.exe| Stage: Defense Evasion |powershell -NoProfile -Command "[IO.File]::SetCreationTime(...)" - Purpose: Execute PowerShell planter to trojanize jQuery files | Tools:
powershell.exe| Stage: Persistence - Purpose: Enumerate IIS sites and virtual directory configuration | Tools:
appcmd.exe| Stage: Discovery |%windir%\system32\inetsrv\appcmd.exe list sites - Purpose: Search source files for cardholder data keywords | Tools:
findstr| Stage: Collection |findstr /s /i /m /c:"CVV" /c:"CardNumber" <path>\*.aspx
- Purpose: SQL database enumeration for cardholder data columns | Tools:
- Other:
wf9x- Webshell authentication key used in first actm7Qx2pL9- Webshell authentication key used in acts 2-4Mozilla/5.0+(Windows+NT;+Windows+NT+10.0;+zh-CN)+WindowsPowerShell/5.1.22621.1037- Attacker user agent indicating zh-CN system localefunction _0x9d66- Idempotency guard string in trojanized jQuery payload
Showing defanged values
- domainchat[.]ririmochii[.]workers[.]devCloudflare Workers subdomain hosting second-stage payload
- domainfk[.]bubuneeko[.]workers[.]devCloudflare Workers subdomain for WebRTC and WebSocket C2
- file_pathC:\Windows\Temp\ccrtc_sdk_init.jsBrowser C2 agent JavaScript dropped on host
- file_pathC:\Windows\Temp\ccrtc_sdk_init.js.b64Base64-encoded browser C2 agent staged on host
- file_pathC:\Windows\Temp\plant_ccrtc_fast.ps1.ps1Low-noise shallow scanner planter dropped on host
- file_pathC:\Windows\Temp\plant_ccrtc_fast.ps1.ps1.b64Base64-encoded fast planter staged on host
- file_pathC:\Windows\Temp\plant_ccrtc_mousewheel.ps1Recursive filesystem scanner planter dropped on host
- file_pathC:\Windows\Temp\plant_ccrtc_mousewheel.ps1.b64Base64-encoded planter script staged on host
- file_pathE:\Content\info\includes\css_bundle.aspxMasqueraded webshell copied to CSS includes directory
- file_pathE:\Content\info\master\jquery.validate.min.aspxMasqueraded webshell copied to master directory
- file_pathE:\Content\management\includes\css_bundle.aspxMasqueraded webshell in management includes directory
- sha2560d8f7bf30aa1ac95d59fed24c433dd2b3d57767f38c088721699c841c6e861d3Recursive filesystem scanner planter script
- sha2560d93c3a8ded46887f79ac4ca7f238c458de2231243176f6c05062e34f238d19aBase64-encoded fast planter script
- sha2565f69ff7a2e024f94cc5f816fa16c90054b09d9ac430b1f8b0631dfdd4472905eBase64-encoded recursive planter script
- sha2567bb594a77f726bf21a49f717024f2915f82f47eb623d2ad305259301de1f1ab4Base64-encoded browser C2 agent JavaScript
- sha256b06b581d91f4108900d188c3ee1af18502a8cb65d4e101663b791bd670867485Browser C2 agent JavaScript file
- sha256e9dee286069afb6b411febb96b91a963cd16baffbf8b6aa951e0ef1a7e0e3879Low-noise shallow scanner planter script
- urlhxxps://chat[.]ririmochii[.]workers[.]dev/core[.]jsSecond-stage browser payload URL loaded by trojanized jQuery
- urlhxxps://fk[.]bubuneeko[.]workers[.]dev/_cf/iceICE/TURN credential fetch C2 endpoint
- urlhxxps://fk[.]bubuneeko[.]workers[.]dev/_cf/relWebRTC signaling and relay C2 endpoint