Threat Actors Compromise NGINX Servers to Redirect Web Traffic

Threat Actors Compromise NGINX Servers to Redirect Web Traffic

First seen 5 Feb 2026, 11:54 UTC •CsoonlineBleepingcomputerCybersecuritynewsGbhackersSecuritybrief.Asia •25.0

Article Content

Browse articles
ThreatCluster

A campaign has been identified where threat actors are compromising NGINX servers to redirect web traffic to malicious sites. The attackers are specifically targeting configurations using the Baota management panel, which is prevalent in Asia. This method involves modifying server settings rather than deploying traditional malware.

How this analysis works

Extracted Entities

1 / 2