Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
15 IOCs
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
Excerpt
Background CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical). Without providing any account or password, an attacker can remotely bypass authentication and take over the cPanel / WHM control panel, allowing an unauthenticated remote attacker to gain administrator…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →15 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | fb1bc3f935fdeb3555465070ba2db33c | High | Score 56/100 | First seen |
| MD5 | 2286f126ab4740ccf2595ad1fa0c615c | High | Score 56/100 | First seen |
| MD5 | e49f68a363c867608972680799389daf | High | Score 56/100 | First seen |
| MD5 | 02a5990b11293236e01f174f5999df20 | High | Score 56/100 | First seen |
| MD5 | 22613c952459e65ce09fb6b5c1c03d47 | High | Score 56/100 | First seen |
| URL | https://wrned.com/log.php?t=3 | High | Score 58/100 | First seen |
| MD5 | 29222f5e73dd10088fcf1204aa21f87f | High | Score 84/100 | First seen |
| MD5 | 9305b4ebbb4d39907cf36b62989a6af3 | High | Score 56/100 | First seen |
| CVE | CVE-2026-41940 | High | Score 77/100 | First seen |
| MD5 | 45fc93426cf08f91c9f9de5f04a12263 | High | Score 56/100 | First seen |
| MD5 | bae1f1bce7c82fa86f05b12e2e254cfc | High | Score 56/100 | First seen |
| MD5 | e1ec6ebb96cf87c785ee6a7da677c059 | High | Score 56/100 | First seen |
| MD5 | 2de27ca8d97124adaf604b18161a441e | High | Score 83/100 | First seen |
| MD5 | 711afb014f64c97d7b31685709c34ce7 | High | Score 56/100 | First seen |
| URL | https://cp.dene.de.com/collect.php | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…