SEA CPanel

On April 29th 2026, watchTowr Labs published research on CVE-2026-41940 , a critical authentication bypass in cPanel & WHM . Within days, reporting from Censys and Ctrl-Alt-Intel made clear that exploitation had rapidly moved from disclosure to in-the-wild abuse.

On 2nd May 2026, Ctrl-Alt-Intel identified an exposed attacker staging server that provided direct visibility into one such operation. From this infrastructure, we observed an unknown threat actor interactively targeting government and military entities in South-East Asia , alongside a smaller set of MSPs and hosting providers in the Philippines, Laos, Canada, South Africa, and the United States. The actor relied heavily on public proof-of-concept code for CVE-2026-41940 .

Exposed threat actor data also detailed a separate custom exploit chain for an Indonesian defence-sector training portal, alongside evidence of earlier exfiltration of Chinese railway-sector data .

The exfiltrated data was centered on the China Railway Society Electrification Committee and related railway electrification organisations. Although the committee itself does not appear to be a government ministry or formal CCP organ, it sits within the China Railway Society , a body that explicitly describes itself as a bridge between the Party, government, and railway scientific and technical workers .

The stolen files map technical, organisational, and personal information from a railway electrification ecosystem that is closely linked to China’s state rail infrastructure and CCP-aligned science governance structures .

CVE-2026-41940 is a authentication bypass impacting cPanel and WHM versions after 11.40. It can allow unauthenticated remote attackers to gain unauthorized access to the control panel.

Threat actors may be able to gain RCE following this via uploading webshells, as discussed in our

The easiest way to think this bug is:

WHM later reloads that session and treats it as if root has already authenticated. So the attacker is not “logging in normally”. They are forging the session state that WHM uses to decide whether someone is logged in.

We encourage reading the watchTowr Labs blog which provides a much better and more detailed explanation

Ctrl-Alt-Intel assess an unknown threat actor, operating from the IP address 95.111.250[.]175 has interactively attempted exploitation of CVE-2026-41940 against primarily:

Unlike the tradecraft discussed in our blog, this threat actor relied on open-source POCs for exploitation:

We have redacted the full domain, although we observed these scripts used multiple times to test for exposures, changing the password to toor , and testing newly created sessions.

watchTowr POC abuse #1

CPanel (CVE-2026-41940) exploitation was a subset of the adverserial activity Ctrl-Alt-Intel recovered from the exposed C2 server.

Ctrl-Alt-Intel assess this threat actor identified novel authenticated SQLi -> RCE vulnerability chain within an Indonesian Defence sector training portal domain. The threat actor appeared to already have valid credentials to this portal.

That SQL injection is then escalated into database-level operating system access by abusing PostgreSQL’s COPY ... TO PROGRAM capability, which allows the database server to spawn shell commands on the host

Within the same directory as the novel exploit chain, we observed the ELF AdaptixC2 payload named 1 . This had C2 configuration delicate-dew.serveftp[.]com:4455

From exposed payloads, we’ve established this threat actor is leveraging AdapdixC2 for Command & Control (C2) over the endpoint delicate-dew.serveftp[.]com:4455 . This can be corroborated with server-side telemetry from Hunt.io :

AdaptixC2 service exposed

We also observed the file init.ps1 , a simple PowerShell-based reverse-shell configured to the C2 IP address:

Ctrl-Alt-Intel assess the threat actor leveraged OpenVPN & Ligolo to establish a pivoting network, providing persistent access to internal victim networks.

The first layer of the actor’s pivot stack was a non-interactive OpenVPN deployment. From the recovered openvpn-install.log , the operator configured an OpenVPN server on 95.111.250[.]175:1194/UDP , using the client subnet 10.8.0.0/24 on the 8th March 2026:

The operator then created a TUN interface named ligolo219138, inserted routes to internal address space, and added forwarding rules between the OpenVPN tunnel and the Ligolo tunnel:

Ctrl-Alt-Intel assess the threat actor established persistent pivot infrastructure via the creation of Linux services, involving masquearading:

A recovered deployment script, temp.sh , creates a hidden directory /usr/local/bin/.netmon , expects a payload named systemd-helper (Ligolo), and writes out a systemd unit called systemd-update.service :

A complete corresponding systemd unit file was also identified:

Ctrl-Alt-Intel recovered evidence, including commands ran and custom scripts, of the threat actor referencing the private IP address 10.16.13.88 :

We assess the threat actor used the OpenVPN & Ligolo stack to pivot into a Chinese victim network, leveraging a custom exfiltration script exfil_docs_v2.sh :

Ctrl-Alt-Intel observed the corresponding loot_docs output folder that contained stolen Chinese data

Before discussing the contents of the stolen files, it is important to note that the victim organisation sits within China’s wider party-state railway science and governance system. The China Railway Society Electrification Committee is not an independent legal entity, but a branch of the China Railway Society , which explicitly commits to CCP leadership , operates under the guidance of CAST , and is supervised within China’s state scientific and railway structures.

In total, 110 files were stolen (~4.37GB). Files were in folders named after the years 2020 , 2021 , … 2024 . This data was stolen in March 2026, although last referenced files from November - December 2024

The exfiltrated data is tightly centered on the China Railway Society Electrification Committee and related railway electrification entities. The filenames show recurring themes:

The non-technical files are arguably the most sensitive, two 2021 payment workbooks contained:

Ctrl-Alt-Intel is not attributing this campaign to any specific threat actor or country. We observed Vietnamese across Python scripts and tooling leveraged, although this alone is not sufficient for attribution.

For example, it is entirely possible the Vietnamese were included to confuse attribution, misleading analysts

The exposed infrastructure examined in this blog provides a useful view into a threat actor that combined speed, opportunism, and persistence . Within days of public disclosure, the actor had leveraged open-source tooling for CVE-2026-41940 and was interactively testing it against South-East Asian government and military entities , as well as internet-facing hosting infrastructure. At the same time, the recovered server also contained a separate custom exploit chain for an Indonesian defence-sector web portal.

Ctrl-Alt-Intel found the activity prior to CPanel / CVE-2026-41940 most interesting. The actor built a durable access layer using OpenVPN , Ligolo , systemd persistence , and then used that access to pivot into an internal network and exfiltrate a substantial corpus of Chinese railway-sector documents.

Although we do not make a firm attribution, the combination of victimology, post-compromise pivoting, and the nature of the exfiltrated data makes this activity more significant than routine opportunistic exploitation. The targeting of South-East Asian military and government infrastructure, combined with confirmed theft of Chinese transport-sector material, is consistent with a broad regional collection effort.