Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches
Attackers breached two major South Korean churches with ERP web shells and IDOR flaws, exposing hundreds of thousands of records.
Oasis Security reported that attackers breached two of South Korea’s largest churches, labeled Victim A and Victim B. At Victim A, the codex_x.aspx web shell in an ERP yielded sysadmin MSSQL access through decrypted configuration secrets, xp_cmdshell execution, and SMB access; roughly 960,000 congregant records, 330,000 donation records, and 47.3 GB across 13,939 files were archived to a MinIO bucket. Victim B started from leaked groupware credentials and IDOR flaws in EKP and SIMS, exposing about 89,000 congregants and 286 employee records and reaching SAP through SSO. The web shell was still internet-accessible on September 9, 2026, and investigators describe the recovered volume as a lower bound.
- Victim A web shell codex_x.aspx ran in the ERP under the IIS app-pool identity.
- Decrypted MSSQL sysadmin credentials enabled xp_cmdshell and linked-server access.
- About 960,000 congregant records and 47.3 GB were uploaded to a MinIO bucket.
- Victim B used leaked groupware credentials and IDOR flaws to reach SAP via SSO.
- Recovered data included payroll, donations, registration photos, and employee records.
- ATT&CK
- T1505.003 Web ShellT1059.003 Windows Command ShellT1021.002 SMB/Windows Admin SharesT1567.002 Exfiltration to Cloud StorageT1190 Exploit Public-Facing Application
- Organizations
- Oasis Security
- Countries
- South KoreaUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 192.3.239.164 | t , collected files from the United States-hosted server at 192.3.239.164 between August 28 and September 1, 2026. The supplied inves |
From the original article
3 min read at gbhackers.com
Attackers breached two of South Korea’s largest churches through distinct intrusion chains, combining an ERP web shell, privileged database access, leaked credentials, and broken authorization controls. Oasis Security’s analysis of attacker-server files documents extensive collection of congregant, employee, financial, and administrative information across both organizations.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.