#ParsedReport #CompletenessHigh
15-09-2026

One Host, Six Operations: How Two Open Directories Exposed a Multi-Target Campaign

https://www.infrahunter.com/research/two-open-directories-on-a-singapore-vps

Report completeness: High

Actors/Campaigns:
Bluedash
Sidewinder

Threats:
Password_spray_technique
Sqlmap_tool
Nuclei_tool
Fscan_tool
Chisel_tool
Supply_chain_technique
Nmap_tool
Screenconnect_tool
Clickonce_tool
Havoc

Victims:
New api gateways, Vietnamese government and military entities, Pakistani government and defence entities, Mexican commercial software platform, Chinese social platform, Data center cooling companies

Industry:
Government, Energy, Military, Chemical, Healthcare, Education

Geo:
Singapore, Liberia, Chinese, Peruvian, Pakistani, Mexican, China, Malaysia, Vietnam, Pakistan, Vietnamese, South korea, Mexico

CVEs:
CVE-2026-59514 [Vulners]
CVSS V3.1: 9.3,
Vulners: Exploitation: Unknown


TTPs:
Tactics: 2
Technics: 11

IOCs:
IP: 8
Domain: 2
File: 21

Soft:
gpt-5, WordPress, BuddyBoss, Laravel, Windows Defender, Nginx, phpMyAdmin, MinIO, Drupal, MySQL, have more...

Algorithms:
chacha20, sha256, hmac

Functions:
inject

Win Services:
WinDefend

Languages:
php, powershell, java