InfoSecBulletin Cybersecurity for mankind
Cyber Threat Intelligence Unit of BGD e-Gov CIRT has found many suspicious files on Bangladesh government infra like gc.txt and uname.txt. Hackers use such files to check unauthorized write access to web servers.
The found artifacts match signs of a big global web defacement campaign that hit Magento systems, first noted on 27 February 2026. This campaign has led to the breach of over 15,000 hostnames from around 7,500 domains globally.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
CIRT found many government infra endpoints with unauthorized files, including gc.txt (defacement claim evidence) and uname.txt (system verification results).
These files typically contain attacker aliases, timestamps, proof-of-compromise messages, and system-level information. Their presence indicates successful exploitation and unauthorized file write access on affected servers.
Attackers commonly use such artifacts to validate intrusions and submit evidence to defacement tracking platforms (e.g., Zone-H).
Technical Root Cause Analysis
The recent campaign is connected to the PolyShell problem (APSB25-94), affecting Magento Open Source and Adobe Commerce platforms.
The flaw is an unauthenticated file upload weakness in the Magento REST API. It lets attackers upload harmful files without needing to log in.
Attack Mechanism: The vulnerability allows attackers to upload files encoded in base64 format through REST API endpoints without proper validation.
Example attack workflow:
POST /rest/V1/products
Content-Type: application/json
Malicious payload example:
{
“file”: “base64_encoded_payload”
}
If server-side validation is misconfigured, the uploaded payload can be written to the filesystem.
Ongoing use of Magento flaw has allowed attackers to upload harmful scripts, keep access to the server, and change website content without permission.
Incident Response Measures:
Immediate actions should be to take away any unauthorized files (like gc.txt, uname.txt). Next, check the whole file system for any problems. Look at web server logs for any strange activity and scan the systems carefully for hidden web shells or backdoors.
Application Security Measures:
All Magento setups need to be updated with the newest security fixes. Unused REST API endpoints should be turned off to lower the risk of attacks. Companies must apply strong checks on file uploads and limit write access in web-accessible folders.
