Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries

Disclosure note: The relevant national CERTs were notified on July 9, 2026, and publication was held for more than the standard 7-day disclosure window.

NGINX sits in front of a large share of the internet's web traffic and Ghost CMS powers well over 100,000 publishing sites. Within months of each other earlier this year, critical vulnerabilities were found in both: NGINX Rift (CVE-2026-42945), a long-standing heap overflow in the rewrite module, and a blind SQL injection in the Ghost Content API (CVE-2026-26980). Exploit code for both became public quickly. What we found was a single host staging them alongside five other exploits, wired to confirm its own hits over out-of-band callbacks.

In June 2026, we identified an exposed directory on a Singapore-hosted VPS, 165.154.236[.]93, built to target these same flaws. The recovered shell history from the directory recorded the attacker running the exploits against live external infrastructure, using out-of-band (OOB) DNS callbacks to verify execution, and using the same server to catch reverse shells. Alongside the web exploits were a broader RCE toolkit and pre-staged install files for AdaptixC2 and SuperShell. The target list spanned eleven countries across five continents and leaned heavily toward high-value sectors: federal and state government, universities, healthcare and financial services. Command-line artifacts, exploit diagrams, and code comments suggest the operator is comfortable with Chinese.

In this post, we will walk through what the rest of the directory revealed, how the attacker operated, and how pivoting on file hashes can lead to additional infrastructure.

Key Takeaways

• The open directory performed double duty as not only an attack server, but also as a reverse-shell listener.

• NGINX Rift (CVE-2026-42945) and Ghost CMS SQLi (CVE-2026-26980) are hosted alongside Splunk, PaperCut, Samba, WebLogic, and D-Link NAS tooling.

• The scripts used DNS callbacks to unique per-target subdomains, over free dynamic-DNS providers, to verify blind execution. The recovered data does not confirm any callback landed.

• AdaptixC2 server, listeners, and agent profiles were present, alongside SuperShell install files. Neither was tied to a specific intrusion in the recovered data.

• Network scan and target lists identify a focus on government, university, healthcare, and financial services environments.

The sections below detail how the directory was found, what the operator was running, and where defenders can pivot.

Discovery and Host Context

While threat hunting, we found an open directory on 165.154.236[.]93 hosted on Scloud Pte Ltd infrastructure (AS142002) in Singapore. The host exposed 572 files across 126 directories, roughly 31 MB in total, served through Python's built-in http.server (SimpleHTTP/0.6, Python 3.12.3). The directory was first captured on 2026-06-16.

Folders named for individual CVEs, CVE-2026-26980, CVE-2026-42945, Nginx-Rift, sat alongside an AdaptixC2 build in a directory named Server, Supershell-fz2.0 and a weblogic folder. The recovered shell history captured the commands run by the operator, including runs of this tooling against the external hosts.

Inside the Exploit Kit

The directory's tooling ranges from well-known (and heavily scanned) bugs to vulnerabilities just a few weeks old. Some of the earlier exploits target PaperCut, Oracle WebLogic, and D-Link NAS devices; the most recent include a Samba print-spooler flaw from late May and a Splunk pre-auth RCE staged within a week of its June 10 disclosure. Two recent web exploits, NGINX Rift and a Ghost CMS SQL injection, account for a majority of the recorded activity and are detailed first.

NGINX Rift (CVE-2026-42945)

NGINX Rift (CVE-2026-42945) is a heap overflow in NGINX's rewrite module, disclosed in May 2026 and heavily documented since. On this host, the operator collected three public PoCs and went a step further, drafting an exploitation diagram that walks through the attack sequence, ending in a system() call.

The working script, poc.py, relies on hardcoded memory addresses, a heap base, a libc base, and the location of libc's system() function. Those values only work on a machine with ASLR disabled and the exact libc build the operator developed against, which suggests this was pointed at a local test box initially. The bash history showed none of the attempts against live hosts were successful.

Pivoting on the SHA-256 hash for poc.py (e0e1ffc5429bb074d5cb7ae3bbfe6f5df6033931a12d24a0d377568150dfa11a) revealed the same file was used over a 30-day period by seven other hosts, across eight endpoints, as one server hosted directories on two ports. The most recent use of the Python script was captured June 26, 2026. A review of the additional IPs showed no links to the directory in question.

Ghost CMS SQL Injection (CVE-2026-26980)

CVE-2026-26980 is an unauthenticated blind SQL injection in the Ghost CMS Content API, disclosed in February 2026 and patched in 6.19.1. Because the Content API key sits in each theme's public HTML, exploitation needs no authentication and can read the site's database, including Admin API keys.

On 165.154.236[.]93, the operator ran the public exploit script, main.py, in two stages. The first pass checks whether a range of IP- and domain-based hosts are vulnerable; against a decreased data set, the script moves to extraction, pulling the email and password-hash columns from the users table into local CSV files. main.py defaults to SQLite, a database commonly used by smaller websites, but the operator overrode this with the -d mysql flag, a backend more common in production deployments. One of the identified hosts in the command history is a major U.S. insurance firm; however, the full set will be discussed in the targeting section.

The CSV output files were not present at the time of archival, so whether any of these credential-extraction attempts succeeded cannot be confirmed. As described above, all that is needed to achieve unauthorized access is a reachable, unpatched Content API.

CVE-2026-26980 is already tied to a separate, larger campaign. In May 2026, QiAnXin XLab reported mass exploitation of the same flaw to inject JavaScript into more than 700 sites for ClickFix lures, work assessed to involve at least two clusters. The activity on 165.154.236[.]93 is a different use of the same bug. Instead of bulk-poisoning public sites, this operator paired vulnerability checks with targeted credential extraction against a hand-picked host list, with Ghost being one CVE among several staged on the server.

The Broader Toolset

Even with a patch available, vulnerabilities never stop being useful. The remaining exploits within the directory, some dating back nearly 10 years to 2017, are a perfect example. More recent flaws in products like Samba and Splunk round out the group but show little or no attempts at execution against live hosts. Several of the scripts contain the same out-of-band verification and Chinese-language comments found elsewhere in the directory.

The Oracle WebLogic tooling is the exception, given what the operator kept alongside the exploit code. The activity is centered around weblogicScanner, an open-source tool covering several WebLogic vulnerabilities, but the operator focused on CVE-2017-10271. This CVE is an XMLDecoder deserialization flaw, which is still widely exploited.

Target lists were organized by country: Brazil, Ireland, Italy, France, South Korea, and the United Kingdom. Paired with these text files were logs recording which hosts were vulnerable. This sub-directory gave insight into the operator's attack planning and target selection. The IPs and domains in the lists skewed heavily towards government, academic, and financial-services organizations.

The full set of observed vulnerabilities staged in the directory is summarized below.

Confirming a remote exploit actually ran as expected is not always straightforward. Responses get filtered or proxied, and failed attempts against one host may look different against another. With this in mind, the operator included an out-of-band flag pointed at a callback server under their control. The injected command forces a DNS lookup to a per-target subdomain on that server, so an incoming lookup confirms the payload executed even when the target's own response is filtered or proxied. The same check appears in other scripts across the directory, and it's something we discuss below.

Operator Tradecraft

The OOB verification described above runs on a small set of external callback domains. In the NGINX Rift and PaperCut scripts, the operator hardcoded requests to: b69415f328.ddns.1433.eu[.]org, 9eac1cf2cb.ddns.1433.eu[.]org, and 2397103e30d34d0c.gobygo[.]net. These domains were tied to each target, so incoming lookups could be matched to the host that produced them

1433.eu[.]org is a free subdomain under the public eu[.]org registry, reached through a dynamic DNS (ddns) host. The PaperCut script also names dnslog[.]cn, a public DNS-logging service, as an example, but it was never used. Because the services are shared and the per-target labels are randomly generated, the route back to the operator is murky, as the DNS records resolve to the providers.

gobygo[.]net is the DNSLog backend for Goby, a Chinese attack-surface-mapping and vulnerability scanning tool. The scripts queried the subdomain in its scans to confirm blind vulnerabilities through DNS. Goby's accounts are managed via the product's official site, gobies[.]org, making panel tracking a losing battle as it belongs to the vendor.

Command and Control

Two post-exploitation frameworks were hosted in the directory. A folder named Server held a full AdaptixC2 build, an openly available red team toolkit with a Golang server and a C++/Qt client. The profile.yaml file contains the default values that ship with each download.

A second folder, named Supershell-fz2.0, held the install files for the open-source, web-managed reverse-shell toolkit. Neither framework was observed tied to a specific intrusion from the recovered data. Similar directories hosting this software can be tracked in AttackCapture. At the time of writing this report, and over the past 30 days, 11 different open directories exposed AdaptixC2 installs the same way as 165.154.236[.]93:8000.

Targeting

The directory's target lists are identified by a two-letter country code, or in files labeled 'ip' followed by a number. The contents of these documents span eleven countries, giving insight into what the operator selected for attack. The exact organizations will not be named as the success.txt files were not among the recovered data.

As mentioned above, the logs for CVE-2017-10271 recorded vulnerable hosts across Brazil, Ireland, Italy, France, South Korea, and the United Kingdom. The additional files seem to be input information only, and concentrate on government, academic, healthcare, and financial sectors:

• Brazil - federal and state government, financial platforms, and healthcare

• Australia - state health departments, universities, and financial services

• South Korea, United Kingdom, Ireland, Italy, France - government, academic

• Indonesia - regency government host

• United States - global insurance firm

• Vietnam, New Zealand - individual private-sector targets

The operator assembled the lists by both country and sectors of interest. This points to a more focused scanning campaign, as opposed to sporadic exploitation which often happens after a vulnerability is disclosed.

Here are the full IOCs from this investigation:

Indicators of Compromise

Conclusion

The directory captured an operator mid-campaign: a single host serving exploits and using OOB to catch their callbacks, exploit code ranging from years-old bugs to vulnerabilities weaponized within days of disclosure, and deliberate targeting across multiple sectors. Simplified Chinese comments in the scripts, along with the use of Supershell and Goby, point to an operator comfortable with the language, though this does not establish identity or a state nexus.

Without the operator's success logs, the activity shows intent and capability but no confirmed compromise. The vulnerabilities affecting NGINX, Ghost, Samba, WebLogic, PaperCut, and Splunk have since been patched. The D-Link NAS flaw (CVE-2024-3273) affects end-of-life devices that will not receive a fix, so exposure there depends on retirement rather than patching. Discovering infrastructure this early, while it is still being assembled, gives defenders actionable intelligence to plug into their own logs and proactively detect similar campaigns.

This directory was exposed while the operator was still working out of it, which is how AttackCapture surfaced the full toolkit, target lists, and C2 setup in one place. Book a demo to see how it fits into your own hunting workflow.