On June 11, 2026, SOCRadar discovered an unauthenticated Python web server (137.175.93[.]126, a US-hosted VPS) that had been left open for 22 days, exposing roughly 800MB of operational data belonging to a Chinese-speaking cybercriminal crew. The trove included exploit scripts, unredacted command history, FOFA search-engine configuration files (FOFA requires a Chinese phone number to register, a strong nationality signal), and target lists naming 1.4 million WordPress and Joomla domains. Ctrl-Alt-Intel (via the Hunt.io open-directory platform) published deduplicated analysis on June 22, 2026 confirming 25,195 sites showed evidence of successful compromise, and SOCRadar's July 9, 2026 writeup counted 5,700+ live webshells still active on infected hosts at time of discovery.

The operation is best characterized as a webshell-access brokerage: automated FOFA-sourced reconnaissance identifies vulnerable WordPress and Joomla installations at scale, a scanner/exploiter framework fires a chain of 11 known plugin/CMS CVEs plus one enterprise Java CVE, and successful hits are backdoored with a custom heavily-obfuscated (four layers of encoding) PHP webshell named down.php, derived from the open-source Chinese webshell kit BestShell. Confirmed access is then packaged and resold to downstream customers rather than monetized directly by the crew, consistent with an initial-access-broker business model.

The single highest-impact vulnerability in the chain is CVE-2026-48907, an improper access control flaw in the Joomla Content Editor (JCE) extension (versions 1.0.0 through 2.9.99.4) that lets an unauthenticated attacker create a rogue editor profile and use it to upload and execute arbitrary PHP, achieving unauthenticated remote code execution with a CVSS score of 10.0. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of 2026-06-19 under BOD 26-04; public exploit code is available and attacks are automated. In this campaign the JCE vector reached 560,000+ candidate targets but yielded only 77 confirmed successful compromises, indicating most sites had already patched or additional exploitation preconditions limited success. By contrast, CVE-2026-3844 — an unauthenticated arbitrary file-upload vulnerability in the Breeze Cache plugin (versions ≤2.4.4, 400,000+ active installs, developed by Cloudways) reachable through the plugin's fetch_gravatar_from_remote function when the 'Host Files Locally – Gravatars' option is enabled — was the volume leader, hitting 45,000+ targets and yielding 17,000+ confirmed backdoors, the bulk of the campaign's total compromise count.

For persistence beyond the initial down.php webshell, the crew deployed a second-stage toolchain consisting of a SNOWLIGHT dropper that loads VShell, a fileless WebSocket-based reverse-shell/RAT, directly into memory using the Linux memfd_create syscall. The resulting process disguises itself as [kworker/0:2] to blend in with legitimate kernel worker threads, which normally have no backing program file, command line, or open network sockets — making its presence a strong host-based detection signal. This SNOWLIGHT-to-VShell toolchain was first documented publicly by Sysdig in April 2025 in connection with the suspected Chinese state-nexus group UNC5174, previously known for using SUPERSHELL and for targeting F5 devices and other edge infrastructure for espionage and access-brokering. Sysdig and other researchers caution that VShell has since proliferated into general Chinese-speaking criminal forums, so its presence alone is not proof of state-actor involvement; this WP-SHELLSTORM operation is independently assessed as financially motivated (webshell brokerage) even though it reuses UNC5174-associated tradecraft. Godzilla, another Chinese-origin webshell/C2 management framework, was also found among the exposed operator's toolset.

A separate but related campaign thread, conducted by the same crew in May 2026 and documented in the exposed command history, targeted corporate Java systems directly via CVE-2021-29441, an authentication bypass in Alibaba Nacos (a widely used service-discovery/configuration-management platform for Java microservices) affecting versions prior to 1.4.1. When Nacos authentication is enabled, its AuthFilter servlet contains a built-in bypass: any request carrying a 'Nacos-Server' User-Agent header is automatically trusted when enableUserAgentAuthWhite is set (the default), and a second bypass exists via a specially crafted trailing-slash URL. Either technique lets an unauthenticated attacker perform full administrative operations against the Nacos console, including reading and querying stored configuration data. Using this bypass, the crew exfiltrated 613 configuration files from 11 distinct corporate systems spanning fintech, e-commerce, logistics, gaming, and electronics sectors, harvesting live cloud and service credentials including AWS, Alibaba Cloud, Oracle Cloud, Tencent Cloud, and DigitalOcean API keys, database passwords, and Alipay RSA private keys — a direct pivot from web-app exploitation into cloud-account takeover.

Operational security on the exposed server was poor: in addition to running an unauthenticated Python HTTP server for 22 days, the crew left their FOFA account configuration (traceable through law-enforcement channels) and unedited shell command history in plaintext, along with loose personal handles (tance, chen-kk, chenyk) that researchers flag as non-confirmatory leads rather than solid attribution. Between July 2 and July 4, 2026 the operator appears to have noticed the exposure and deleted a batch of log files, though the bulk of the operational data had already been mirrored by researchers. A secondary access log showed 42,000+ tool-download requests originating from a Taiwan-based IP address; researchers could not determine whether this reflected the operator, a downstream customer, or another security researcher.

The remaining plugin CVEs in the exploitation chain — CVE-2026-3300 (Everest Forms Pro), CVE-2026-1969 (ThemeREX Addons / trx_addons, an incorrect fix for the earlier CVE-2024-13448 unauthenticated arbitrary file upload), CVE-2020-36847 (Simple-File-List, RCE via the plugin's rename function on versions ≤4.2.2), CVE-2026-6433 (Custom CSS & JS / PHP inline-code injection plugin), CVE-2025-7443 (BerqWP), CVE-2026-0740 (Ninja Forms upload handling), CVE-2025-12057 (WavePlayer), CVE-2025-7852 (WPBookit), and CVE-2020-25213 (WP File Manager, unauthenticated arbitrary file upload on versions <6.9, mass-exploited historically per Palo Alto Unit 42 and Wordfence tracking) round out a chain deliberately built from cheap, widely-deployed, and in several cases years-old unpatched WordPress/Joomla plugin vulnerabilities — reflecting a brokerage strategy optimized for breadth of coverage across the CMS plugin ecosystem rather than depth against any single target.