InfoSecBulletin Cybersecurity for mankind
Cyber Threat Intelligence Unit of BGD e-Gov CIRT has found many suspicious files on Bangladesh government infra like gc.txt and uname.txt. Hackers use such files to check unauthorized write access to web servers.
The found artifacts match signs of a big global web defacement campaign that hit Magento systems, first noted on 27 February 2026. This campaign has led to the breach of over 15,000 hostnames from around 7,500 domains globally.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
CIRT found many government infra endpoints with unauthorized files, including gc.txt (defacement claim evidence) and uname.txt (system verification results).
These files typically contain attacker aliases, timestamps, proof-of-compromise messages, and system-level information. Their presence indicates successful exploitation and unauthorized file write access on affected servers.
Attackers commonly use such artifacts to validate intrusions and submit evidence to defacement tracking platforms (e.g., Zone-H).
Technical Root Cause Analysis
The recent campaign is connected to the PolyShell problem (APSB25-94), affecting Magento Open Source and Adobe Commerce platforms.
The flaw is an unauthenticated file upload weakness in the Magento REST API. It lets attackers upload harmful files without needing to log in.
Attack Mechanism: The vulnerability allows attackers to upload files encoded in base64 format through REST API endpoints without proper validation.
Example attack workflow:
POST /rest/V1/products
Content-Type: application/json
Malicious payload example:
{
“file”: “base64_encoded_payload”
}
If server-side validation is misconfigured, the uploaded payload can be written to the filesystem.
Ongoing use of Magento flaw has allowed attackers to upload harmful scripts, keep access to the server, and change website content without permission.
Incident Response Measures:
Immediate actions should be to take away any unauthorized files (like gc.txt, uname.txt). Next, check the whole file system for any problems. Look at web server logs for any strange activity and scan the systems carefully for hidden web shells or backdoors.
Application Security Measures:
All Magento setups need to be updated with the newest security fixes. Unused REST API endpoints should be turned off to lower the risk of attacks. Companies must apply strong checks on file uploads and limit write access in web-accessible folders.
