Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Attacker uploaded ASPX webshells to a shared parks-and-rec platform, hitting three servers and hunting cardholder data.
On September 10, 2026, Huntress tracked an attacker who compromised multiple tenants of a shared parks-and-recreation management platform. After failed brute-force, IIS 8.3 tilde enumeration, and WebDAV attempts, the actor registered a member account and uploaded ASPX webshells to /documents/MemberFiles/. The shells enumerated Windows and IIS configuration and searched for cardholder data on payment tenants across three web servers. The attacker added anti-forensics and regained access after one server was cleaned but not fully locked down.
- On September 10, 2026, one actor compromised multiple platform tenants.
- Failed probes included login brute force, IIS tilde enumeration, and WebDAV.
- A new member account allowed ASPX webshell uploads to MemberFiles.
- Shells enumerated Windows and IIS and hunted for cardholder data.
- The attacker returned after cleanup because access was not fully locked down.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bubuneeko.workers.dev | l() frames and harvest credentials in real time: hxxps://fk.bubuneeko[.]workers[.]dev/_cf/rel hxxps://fk.bubuneeko[.]workers[.]dev/_cf/ice ws |
| domain | chat.ririmochii.workers.dev | d305259301de1f1ab4 Base64-encoded JavaScript file hxxps[://]chat[.]ririmochii[.]workers[.]dev/core[.]js Second stage "core" payload URL hxxps[://]f |
| domain | fk.bubuneeko.workers.dev | s[.]dev/core[.]js Second stage "core" payload URL hxxps[://]fk[.]bubuneeko[.]workers[.]dev/_cf/rel WebRTC signaling/relay URL hxxps[://]fk[.]bub |
| domain | ririmochii.workers.dev | y file injected a secondary browser agent from hxxps://chat.ririmochii[.]workers[.]dev/core[.]js , establishing encrypted WebRTC and WebSocket |
| sha256 | 0d8f7bf30aa1ac95d59fed24c433dd2b3d57767f38c088721699c841c6e861d3 | t used during the attack Plant_ccrtc_mousewheel.ps1 SHA256: 0d8f7bf30aa1ac95d59fed24c433dd2b3d57767f38c088721699c841c6e861d3 PowerShell script file Plant_ccrtc_mousewheel.ps1.b64 SHA25 |
| sha256 | 0d93c3a8ded46887f79ac4ca7f238c458de2231243176f6c05062e34f238d19a | 879 PowerShell script file Plant_ccrtc_fast.ps1.b64 SHA256: 0d93c3a8ded46887f79ac4ca7f238c458de2231243176f6c05062e34f238d19a Base64-encoded PowerShell script file Ccrtc_sdk_init.js SHA |
| sha256 | 5f69ff7a2e024f94cc5f816fa16c90054b09d9ac430b1f8b0631dfdd4472905e | werShell script file Plant_ccrtc_mousewheel.ps1.b64 SHA256: 5f69ff7a2e024f94cc5f816fa16c90054b09d9ac430b1f8b0631dfdd4472905e Base64 encoded PowerShell script file Plant_ccrtc_fast.ps1 |
| sha256 | 7bb594a77f726bf21a49f717024f2915f82f47eb623d2ad305259301de1f1ab4 | 91bd670867485 JavaScript file Ccrtc_sdk_init.js.b64 SHA256: 7bb594a77f726bf21a49f717024f2915f82f47eb623d2ad305259301de1f1ab4 Base64-encoded JavaScript file hxxps[://]chat[.]ririmochii[ |
| sha256 | b06b581d91f4108900d188c3ee1af18502a8cb65d4e101663b791bd670867485 | 64-encoded PowerShell script file Ccrtc_sdk_init.js SHA256: b06b581d91f4108900d188c3ee1af18502a8cb65d4e101663b791bd670867485 JavaScript file Ccrtc_sdk_init.js.b64 SHA256: 7bb594a77f726 |
| sha256 | e9dee286069afb6b411febb96b91a963cd16baffbf8b6aa951e0ef1a7e0e3879 | encoded PowerShell script file Plant_ccrtc_fast.ps1 SHA256: e9dee286069afb6b411febb96b91a963cd16baffbf8b6aa951e0ef1a7e0e3879 PowerShell script file Plant_ccrtc_fast.ps1.b64 SHA256: 0d9 |
| url | https://chat.ririmochii.workers.dev/core.js | janized jQuery file injected a secondary browser agent from hxxps://chat.ririmochii[.]workers[.]dev/core[.]js , establishing encrypted WebRTC and WebSocket channel |
| url | https://fk.bubuneeko.workers.dev/_cf/ice | in real time: hxxps://fk.bubuneeko[.]workers[.]dev/_cf/rel hxxps://fk.bubuneeko[.]workers[.]dev/_cf/ice wss://fk.bubuneeko[.]workers[.]dev/_cf/soc Figure 4: Th |
| url | https://fk.bubuneeko.workers.dev/_cf/rel | dynamic eval() frames and harvest credentials in real time: hxxps://fk.bubuneeko[.]workers[.]dev/_cf/rel hxxps://fk.bubuneeko[.]workers[.]dev/_cf/ice wss://fk.b |
From the original article
10 min read at huntress.comHuntress SOC found a threat actor exploiting a file upload flaw in recreation management to breach 3 municipal servers and steal payment data.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.