Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Hackers Scan CMS Websites Globally to Deploy Webshells and Steal Credentials
Malware Families
Excerpt
A large-scale cyber exploitation campaign is actively targeting Content Management System (CMS) websites worldwide. Cybercriminals are aggressively scanning web servers to find unpatched software and vulnerable plugins. By exploiting these weaknesses, attackers deploy malicious webshells to gain remote control over compromised websites. This campaign has impacted numerous organizations globally, including a significant number of small- to medium-sized businesses. The rapid…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-0740 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-31843 | Medium | Score 51/100 | First seen |
| CVE | CVE-2020-36847 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-7852 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-13486 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-34085 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-1969 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-3844 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-7443 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-12057 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…