Security researchers at SOCRadar exposed a sophisticated, China-linked web application backdoor operation dubbed WP-SHELLSTORM in early July 2026. The operation, attributed to a financially motivated Webshell Access Brokerage Operation (WABO), runs two parallel campaigns targeting CMS platforms and enterprise Java infrastructure. Campaign A has identified over 1.4 million domains as reconnaissance targets and confirmed more than 5,700 active webshells across WordPress, Joomla, PrestaShop, Craft CMS, and MetInfo installations, exploiting a portfolio of 27 known CVEs to establish persistent access and sell it to downstream threat actors.
The researchers’ visibility into the operation came from an unusual gift: the threat actors exposed their own command-and-control server (137.175.93[.]126), which contained approximately 800MB of operational data including webshells, exploit scripts, scan results, bash history, and C2 configurations. A second high-precision campaign (Campaign B) targeted enterprise Java infrastructure — Apache Nacos, XXL-Job, and Spring Boot — compromising 11 victims and exfiltrating 613 configuration files including cloud credentials and payment system keys.
Source: SOCRadar Blog | The Hacker News
Commentary: The 1.4 million-domain reconnaissance scope is eye-catching, but the real value here is what the exposed C2 server reveals about how industrial-scale webshell brokerage operations actually work. This isn’t a sophisticated APT running bespoke zero-days — it’s a commodity access operation systematically scanning for known CVEs and packaging the access for sale. The exposed bash history and scan tooling give defenders and threat intel teams a rare look at the full operator workflow.
For defenders, the mitigation path is frustratingly familiar: patch the 27 CVEs being exploited, deploy WAF rules for those patterns, and run file-integrity monitoring on web roots. The harder problem is scale — with 5,700+ active webshells confirmed, the number of organizations unknowingly hosting access brokers’ infrastructure is substantial. If you run any internet-facing CMS, treat this as a fire drill.