Security researchers detailed an attack campaign targeting network defense devices across 25 systems globally, combining PHP vulnerabilities and a Linux kernel issue to gain full control over exposed management pages.
The attack targeted devices running specific versions of software from a major manufacturer, which was not named. The attackers combined two flaws in the software used by the devices with another flaw in their underlying operating system to gain complete control over them. Dream observed the activity on October 25, 2026. Its findings were published by The Hacker News on October 28.
How the devices were detected
According to Dream, the attackers used the FOFA service to identify approximately 19.000 devices with web-accessible management pages. Approximately 5.000 of these revealed which software version they were running. Dream says the checks led to the selection of 240 devices as targets.
The attackers initially took control of 24 devices and later one more, bringing the total to 25. Two of the first devices were in the environment associated with the US organization. One of them stopped working on October 23, 2026, at 18:14 UTC, and did not come back on. The attackers took control of the second on October 24, at 10:09 UTC.
Through the second device, they established a connection to the organization's internal network. At 11:35 UTC on the same day, they took control of a third device, which they could only reach through this connection.
What did they try to do within the network?
The attackers targeted the internal system that manages accounts. They attempted to find a password used by a service, record users, try organization-related passwords on accounts, and create hidden accounts.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
South Korea: Personal information of 38.490 Daishin customers exposed
↗
Dream found evidence that the perpetrators obtained login credentials and registered accounts. However, it is unclear whether they found working passwords or were able to create hidden accounts.
Indications for the use of artificial intelligence
The infrastructure used for the attack included Anthropic's Claude Code, FOFA credentials, and the aiscan tool, configured with the DeepSeek and Kimi models. Dream also noted that the structure, comments, and similarity across nearly 40 programs suggest that artificial intelligence may have been used to create them. This is an indication, not definitive proof.
Dream said 22 of the devices still had software installed that allowed someone to control them from another location. It also estimated that the connection to the US agency's internal network was likely still active.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)