A sophisticated cyber attack campaign targeting South Korean web servers has emerged, with threat actors deploying MeshAgent and SuperShell malware to compromise both Windows and Linux infrastructure. Evidence suggests the threat actors maintain operations across both Windows IIS servers and Linux systems, indicating a well-resourced operation with cross-platform capabilities that spans multiple operating system architectures. The discovered malware repository contains WogRAT, a backdoor that shares infrastructure with previous attack campaigns, suggesting operational continuity by the same threat group across multiple attack vectors. The campaign represents a significant evolution in web server exploitation tactics, where attackers initially gain access through vulnerable file upload mechanisms before deploying an arsenal of reconnaissance and persistence tools. The researchers noted that these tools, combined with Chinese-language reconnaissance utilities like Fscan and Ladon, strongly indicate Chinese-speaking threat actors orchestrating the campaign through coordinated infrastructure management. The multi-platform assault demonstrates an escalation in attack complexity, as adversaries leverage file upload vulnerabilities to establish persistent footholds across diverse server environments. This methodical approach demonstrates advanced persistent threat characteristics, with the ultimate objective remaining undetermined but potentially involving sensitive data exfiltration or ransomware deployment across organizational infrastructure. Following initial reconnaissance, the threat actors deploy SuperShell, a Go-language reverse shell supporting Windows, Linux, and Android platforms. The malware establishes persistence through MeshAgent, which provides comprehensive remote management functions including file transfer, command execution, and web-based remote desktop access. The attack methodology follows a systematic approach beginning with web shell deployment through file upload vulnerabilities in web server configurations.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 27 Jun 2025 15:15:12 +0000