FHN 
A recent cyberattack campaign shows how attackers can turn vulnerable firewall management services into a gateway for deeper network access. Researchers at Dream uncovered evidence of attackers exploiting PHP2Shell vulnerabilities alongside a Linux kernel flaw to obtain root privileges on 25 systems across four countries.
The affected systems were located in the United States, Japan, Taiwan, and South Korea. Three systems were reportedly associated with a US government-affiliated environment, raising concerns about the potential exposure of sensitive network infrastructure.
Investigators discovered the campaign’s tools and activity records on October 25. The collected files included custom exploit code, target information, attack logs, and approximately 40 scripts designed to support activity after the initial compromise.
From Exposed Firewalls to Root-Level Control
The attackers reportedly combined PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with the Linux kernel privilege escalation flaw Fragnesia (CVE-2026-46300).
Rather than relying on a single vulnerability, the operation used a sequence of exploits to move from limited access to full system privileges. The initial attack targeted a firewall’s web management service, where a weakness in PHP session upload progress handling helped attackers execute commands.
The Linux kernel exploit was then used to elevate privileges to root. Dream reported that the complete sequence could establish a root-level webshell in less than 15 minutes.
The campaign reportedly involved several stages:
- Target discovery: Attackers searched for exposed firewalls using FOFA.
- Victim selection: Software version information and geographic filters reduced the potential target list.
- Initial compromise: Custom PHP2Shell exploit code was used against vulnerable management services.
- Privilege escalation: A Linux kernel vulnerability helped attackers obtain root access.
- Persistence: Webshells and supporting scripts provided a way to maintain access.
Researchers reported approximately 19,000 internet-facing firewalls in the initial search results. Around 5,000 disclosed version information, and further filtering narrowed the list to 240 potential targets.
Internal Network Access Raises Further Concerns
The investigation uncovered activity involving two firewalls connected to a US government-affiliated organization. Following a crash on the first device, the attackers reportedly gained access to a second firewall on October 24.
They established a reverse SSH tunnel that forwarded eight internal ports and configured the connection to persist across reboots. This gave them a route into systems that were not directly exposed to the internet.
The attackers subsequently reached an internal firewall management server, bringing the total number of compromised systems to 25. Access to this server potentially exposed centrally managed configurations and credentials.
Investigators also found evidence that the attackers decrypted an LDAP service account password and queried Active Directory for user and group information.
Additional activity included attempts to spray passwords, create unauthorized accounts, and steal SAML signing keys. However, the investigation has not confirmed whether these actions succeeded or whether the attackers achieved broader domain control.
What Security Teams Should Do
The incident highlights the risks of exposing firewall administration services to untrusted networks. A compromised perimeter device can become a stepping stone toward internal systems, identity services, and sensitive credentials.
Security teams should prioritize the following actions:
- Patch vulnerable systems: Follow the firewall vendor’s official guidance for affected software versions.
- Restrict management access: Allow administrative interfaces only from trusted networks or approved access paths.
- Investigate persistence: Search for unexpected webshells, reverse SSH tunnels, startup changes, and unfamiliar scripts.
- Secure exposed credentials: Rotate potentially compromised passwords and service account secrets.
- Review identity activity: Examine Active Directory authentication, account creation, and SAML signing key access for suspicious behavior.
Dream also found AI coding and scanning tools on recovered systems, including Claude Code and configurations for DeepSeek and Kimi. Although researchers noted Chinese-language prompts and timestamps consistent with UTC+8, they did not establish a confirmed attacker identity or prove that AI generated the exploit code.
About the Author
