Suspected Sidewinder Campaign Against South Asian Governments and Finance Targets

While threat hunting, we identified an exposed VPS at 66.179.31[.]191 hosted on BL Networks (AS399629) in Singapore.

The host ran a Python SimpleHTTP server on port 8898 with directory listing enabled. AttackCapture archived the directory and flagged it as a potential malicious open directory. What it exposed was a working attack server: 395 files across 9 subdirectories, roughly 182 MB, containing exploit code for GeoServer, GeoTools, Laravel Ignition, Tomcat, and a Redis module loader, along with phpMyAdmin weak-credential scripts, target lists, session cookies, C2 configuration, and operational logs.

The same host was tied on ThreatFox to a Sliver botnet C2 on port 31337 at 75 percent confidence. Recovered configuration files include a Sliver operator profile under the alias 'wren'. Scripts in the directory carry Chinese-language comments, and the operator used out-of-band DNS callbacks through Goby's DNSLog backend for verification. The tooling and target selection overlap with tradecraft publicly attributed to Sidewinder, though the recovered data is not sufficient to confirm attribution.

Key Takeaways

• A Singapore-hosted VPS at 66.179.31[.]191, on BL Networks (AS399629), served as an attack server and a reverse-shell listener. Hunt.io flags it as High Risk with an Active Malware tag for Vshell, and it exposed 395 files across 9 sub directories through an open directory on port 8898
• ThreatFox ties the same IP to a Sliver botnet C2 on port 31337, with a confidence of 75 percent. Recovered configuration files include a Sliver operator profile under the alias 'wren'
• The staged toolkit covers GeoServer and GeoTools (CVE-2026-76904), Laravel Ignition (CVE-2021-3129), Tomcat manager deployment, a Redis module loader, and phpMyAdmin weak-credential testing
• The operator ran a persistent out-of-band HTTP callback server on port 14333, and separately deployed and later removed an interactsh instance, consistent with verifying exploitation and covering tracks
• Sliver and Vshell infrastructure were staged alongside the toolkit
• Target lists concentrate on government, academic, healthcare, and financial services organizations across South Asia, with additional private-sector targets in other regions
• The tooling and victimology overlap with trade craft publicly attributed to Sidewinder. Recovered data does not confirm attribution or identify a state nexus

Discovery and Host Context

The IP sits inside the 66.179.30.0/23 block, announced under AS399629. Beyond the High Risk and Active Malware flags already noted, the Hunt.io IP Details lists ten open ports, and their first-seen dates lay out a timeline worth pulling apart on its own.

SSH on port 22 is the oldest service on the host, reachable since 05/25/2026, four months before the rest of the environment took shape. Everything else arrived much later and in two distinct waves. A TLS listener on 8443 came up on 09/05/2026 and disappeared again by 09/06/2026. An HTTP service on 8082 followed on 09/09/2026, and the Vshell-tagged service on 8099 appeared the next day, 09/10/2026. Then, on 09/13/2026, five ports came online at once: 6666 (Redis), 8877 (unknown), 8898 (the Attack Capture directory), 17765 (unknown), and 25777 (unknown).

Figure 03: Hunt.io Open Ports and Software table for 66.179.31.191, showing all ten ports with first-seen and last-seen dates

That clustering, one stable SSH service against a burst of five new ports on the same day the open directory was captured, points to a host that was still being assembled rather than one in settled, long-term use. The Vshell and Attack Capture services both landed inside that same short build-out window, which is consistent with the directory being exposed close to when it was actually populated, not left forgotten from an older deployment.

Inside the Open Directory

The 395 files break down into a handful of clear categories: exploit scripts organized roughly by target product, credential and cookie files, C2 and post-exploitation configs, and operational logs. Nothing in the directory was organized into folders named after the products themselves; scripts, configs, and logs sit largely at the top level or in a small number of generic sub directories.

GeoTools/GeoServer SQL Injection (CVE-2026-76904)

CVE-2026-76904 is a critical SQL injection vulnerability in GeoTools' jsonArrayContains function, present from version 30.5 up to the patched releases 33.6 and 34.5. GeoTools is embedded inside GeoServer to handle geospatial data, so the flaw is reachable through GeoServer's PostGIS-backed endpoints, letting an unauthenticated or low-privileged request inject arbitrary SQL through a crafted jsonArrayContains query.

On 66.179.31[.]191, the operator built out a full attack chain around this flaw rather than a single script. cve76904.py targets the vulnerability directly, while a supporting family of scripts, geoserver_xxe.py, geoserver_deep_exploit.py, geoserver_master_exploit.py, geoserver_rce.py, geoserver_reset_pg.py, geoserver_rest_exploit.py, geoserver_admin_full.py, and geoserver_sqlview.py, covers the rest of the lifecycle against an exposed instance: authentication, admin password reset, JSP webshell deployment, path traversal reads, workspace creation, and SQL view abuse for file reads via pg_read_file. Several scripts hard-code the same target pair, 202.4.127[.]189:8880 and 202.4.127[.]190:8089, alongside default credentials admin:redacted and a recovered master password. Recovered cookie files (gs_admin.txt, gs_cookies.txt, gs_cookies2.txt) tie a live session to a SriLankan government GIS instance, slramsgis.rda.gov[.]lk.

Laravel Ignition Remote Code Execution (CVE-2021-3129)

CVE-2021-3129 is a remote code execution vulnerability in Laravel applications running with Ignition's debug mode enabled. The flaw allows an attacker to abuse the /_ignition/execute-solution endpoint to write an arbitrary file, typically a PHP archive (PHAR) payload, into a location Laravel will later include, achieving code execution without authentication.

The recovered script set (ignition_auto.py, ignition_exploit.php, debug_ignition.py, debug_targets.py, exploit.py, find_writable.py, write_2step.py, write_final.py, write_targets.py) targets ems.emarketingeye[.]dev and follows the standard exploitation pattern for this bug: writing a base64-encoded PHAR payload into Laravel's log file, then including it through a phar:// wrapper to trigger deserialization and execute code.

Tomcat Manager WAR Deployment

Separate from the CVE-numbered exploits, the operator staged a generic Apache Tomcat attack: building a JSP webshell, packaging it into a WAR file, and deploying it through the Tomcat Manager interface, a well-known post-authentication abuse path rather than a specific vulnerability. deploy_war.sh, exploit.py, exploit2.py, and exploit3.py carry out this chain using hardcoded credentials admin:redacted against a recorded target, 172.25.6[.]5:9092.

Redis Module RCE

The Redis module set (build_module.sh, build.sh, deploy_module.py, system.so, evil.c, listener.sh) compiles a malicious Redis module exposing system.exec and system.revshell commands, a known Redis post-exploitation technique rather than a CVE-specific bug, and delivers it to a target via MySQL INTO DUMPFILE before loading it as a Redis module. The recorded target is 42.51.100[.]39, with credentials redacted. rogue.log shows this technique in active use elsewhere on the host, with the same module loaded against a connecting peer at 119.45.14[.]15.

phpMyAdmin Weak-Credential Testing

pma_brute.py tests weak or default phpMyAdmin credentials against five recovered targets, hr.dam.gov[.]bd/phpmyadmin, dnams.btrc.gov[.]bd/phpmyadmin, lib.bim.gov[.]bd/phpmyadmin, wqmis-backend.phedkp.gov[.]pk/phpmyadmin, and devlims.land.gov[.]bd/pma, all of which sit on Bangladeshi and Pakistani government infrastructure.

Figure 10: Contents of pma_brute.py, showing the target list and credential-testing loop

Additional Credential Material and Reconnaissance Tooling

Beyond the exploit-specific cookies noted above, the directory held a broader set of session cookie files (dcbuner_db.txt, dcbuner_j4.txt, dcbuner_jar2.txt, energy_cookies.txt, hr_cookies.txt, hr_kp_c.txt, hr_kp_login_cookies.txt, hr_login_cookies.txt, hr_pma_cookies.txt, forged_headers.txt) in Netscape cookie-jar format, along with icc_app_config.txt, which contains plaintext database, Kafka, Redis, and Elasticsearch credentials plus embedded key material. Two Nuclei template references, tpl_cpanel_whm.txt and tpl_laravel.txt, point to additional vulnerability-scanning capability beyond the scripts described above, though the template content itself was not recovered.

Out-of-Band Verification and Operational Logs

Alongside the exploit scripts, the directory held infrastructure the operator used to confirm exploitation and to run and later cover their tracks.

OOB callback server. deploy_oob.sh installs and enables a persistent systemd service running an oob_server.py listener on port 14333, with callback logs written to /var/log/oob/callbacks.log. The script contains Chinese-language install and status messages and confirms the listener is active via ss -tlnp after startup.

Operational logs. Several log files recovered from the directory point to live, in-progress activity rather than static tooling:

• batch_runner.log shows repeated invocations of pdhttpx, a bulk HTTP probing tool, run against list-based input with JSON output written to /tmp and stdout/stderr suppressed. Several entries end in Terminated, indicating the processes were killed rather than completing normally.
• rogue.log records a Redis exploitation run in progress: loading of a malicious shared object (exp.so, 44320 bytes), a Redis listener bound to 0.0.0.0:15000, and repeated connections and RDB payload sends from 119.45.14[.]15, an address attributed to Huawei Cloud infrastructure in China. The log contains Chinese-language status messages.
• nc_rev.txt records a netcat listener session with a peer at 115.89.253[.]189, attributed to LG DACOM in South Korea.
• httpserver.log logs a GET /linux_beacon_new request from 150.158.85[.]137, attributed to Tencent Cloud infrastructure in China. The requested path matches the naming convention used for Sliver implants generated elsewhere in the directory.
• shell_16653.log shows an interactive root shell session (root@redacted-vm:/#) with a connecting peer at 103.69.124[.]253.

Taken together, these logs show an operator actively exploiting, verifying, and shelling into remote hosts from this VPS, not just staging tooling for future use.

Command and Control Infrastructure

Two C2 frameworks are staged on the host: Sliver and Vshell.

Sliver. A gen_implant.py script generates Sliver implants, with a listener configured on 0.0.0.0:80 and generated payloads written to /opt/sliver-implants/. The recovered implant naming convention includes linux_beacon, which matches the beacon path (/linux_beacon_new) requested in httpserver.log from the Tencent Cloud-attributed IP noted in the previous section. The C2 callback address embedded in the generated implants is http://66.179.31[.]191.

An operator configuration file, wren.cfg, was also recovered. It contains a Sliver operator profile for an alias wren, including a connection token, an lhost of 66.179.31[.]191, an lport of 31337, a CA certificate, an EC private key, and an operator certificate. This is consistent with the ThreatFox tie noted earlier, a Sliver botnet C2 flagged on 66.179.31[.]191:31337 at 75 percent confidence.

Vshell. Hunt.io separately flagged port 8099 on this host as Active Malware: Vshell. Recovered files support that tag directly. build_module.sh compiles a Redis module exposing system.exec and system.revshell commands, the same mechanism used in the Redis module RCE scripts covered above. A vshell.log file records license information, a web management interface on port 8082, and a listener bound to 0.0.0.0:8099, matching the port Hunt.io flagged. A separate script, slt_public.sh, functions as a multi-architecture stage loader and contains at least one Chinese-language comment; its naming (slt_public.sh, referencing an f528764dtcp string internally) lines up with tooling associated with the Vshell/Snowlight family.

Additional listener tooling. A standalone evil.c file defines an LD_PRELOAD constructor that spawns a bash reverse shell back to 66.179.31[.]191:8899 on load, functioning as a lightweight persistence/backdoor mechanism separate from the two frameworks above. A listener.sh script sets up a simple netcat listener (nc -l -v -n -p 18888 -e /bin/bash) as a fallback catch-all.

Together, the operator had two distinct C2 frameworks staged and configured for use against the same host, plus at least two lower-effort fallback listener mechanisms, rather than relying on a single tool set.

Targeting and Victimology

The recovered target lists are overwhelmingly government-focused across four South Asian countries, with a clear tilt toward defence, intelligence, and other high-sensitivity functions rather than routine civil administration alone.

Pakistan. Coverage spans the full armed forces structure, including the Pakistan Navy, Pakistan Air Force, Pakistan Army recruitment infrastructure, the Inter Services Selection Board, the National Aerospace Science and Technology Park, the Pakistan Coast Guards, and the Anti-Narcotics Force. It also reaches into nuclear and strategic institutions, the Pakistan Atomic Energy Commission and the Space and Upper Atmosphere Research Commission (SUPARCO), as well as intelligence and internal security bodies including the Intelligence Bureau, the National Counter Terrorism Authority, and a dedicated federal cybercrime unit. On the civilian side, the list covers federal ministries and regulators (the tax authority, the securities regulator, the national ID authority, the disaster management authority, the Election Commission of Pakistan), provincial governments across Punjab, KP, Sindh, Balochistan, and Gilgit-Baltistan, the judiciary, and police services in multiple provinces.

Bangladesh. The set includes the Armed Forces Division, the Ansar and Village Defence Party (a state paramilitary force), the National Cadet Corps, and the Rapid Action Battalion, alongside cabinet and ministry domains, the president's office, tax and revenue systems, and health authorities. A large share of the Bangladeshi entries are UUID-prefixed municipal and district subdomains that appear enumerated rather than hand-picked.

Sri Lanka. Coverage includes the Sri Lanka Air Force, the Coast Guard, and defence-adjacent infrastructure, alongside the President's Office, Cabinet Office, customs, immigration, and treasury systems.

Nepal. The list is anchored by Nepal Police, with province-level infrastructure spanning all seven provinces plus dedicated crime, traffic, and narcotics control divisions, and by the Armed Police Force, including its training and medical infrastructure. Civil coverage includes the President's Office, Parliament, the Office of the Prime Minister and Council of Ministers, and the Ministry of Home Affairs.

Live exploitation targets versus bulk reconnaissance. This enumerated list is far broader than the small set of endpoints that actually appear inside working exploit scripts and cookie files, GeoServer/GIS instances, a Laravel deployment, a Tomcat instance, a Redis host, and five phpMyAdmin panels, most of which sit on Bangladeshi and Pakistani government infrastructure. None of the defence, intelligence, or nuclear-linked entities named above appear directly referenced inside the recovered exploit code; they surface only in the bulk reconnaissance lists, consistent with broad scanning or enumeration rather than confirmed, targeted exploitation of those specific entities.

The lists also contain a substantial number of typo squatted and lookalike domains mimicking legitimate government portals, suggesting they were built at least partly through automated scraping rather than manual selection.

No confirmed compromise of any government, military, or law-enforcement system is evident from the recovered data. What the directory shows is scanning, enumeration, and credential-testing capability aimed at a target set that includes some of the most sensitive defence, intelligence, and nuclear-adjacent institutions across all four countries.

Indicators of Compromise

MITRE ATT&CK Mapping

Conclusion

The evidence from 66.179.31[.]191 points to an operator still building out infrastructure rather than one caught mid-intrusion. Most services appeared within days of each other, and the recovered logs show live scanning, exploitation attempts, and shell sessions in progress rather than static, unused tooling. Two C2 frameworks, Sliver and Vshell, were staged alongside a persistent OOB callback server, with a cleanup script used to erase traces of a separate interaction tool.

Targeting reaches beyond routine civil administration into defence, intelligence, and nuclear-adjacent institutions across Pakistan, Bangladesh, Sri Lanka, and Nepal. The credential dumps, forged cookies, and large domain-typo-squat lists recovered alongside the exploit code suggest more than one possible end goal, ranging from direct system compromise to credential harvesting to staging infrastructure for phishing and lookalike-portal operations against the same targets. Chinese-language artifacts and tooling overlap with trade craft publicly attributed to Sidewinder, but the data does not confirm attribution.