InfoSecBulletin Cybersecurity for mankind
Cyber Threat Intelligence Unit of BGD e-Gov CIRT has found many suspicious files on Bangladesh government infra like gc.txt and uname.txt. Hackers use such files to check unauthorized write access to web servers.
The found artifacts match signs of a big global web defacement campaign that hit Magento systems, first noted on 27 February 2026. This campaign has led to the breach of over 15,000 hostnames from around 7,500 domains globally.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT found many government infra endpoints with unauthorized files, including gc.txt (defacement claim evidence) and uname.txt (system verification results).
These files typically contain attacker aliases, timestamps, proof-of-compromise messages, and system-level information. Their presence indicates successful exploitation and unauthorized file write access on affected servers.
Attackers commonly use such artifacts to validate intrusions and submit evidence to defacement tracking platforms (e.g., Zone-H).
Technical Root Cause Analysis
The recent campaign is connected to the PolyShell problem (APSB25-94), affecting Magento Open Source and Adobe Commerce platforms.
The flaw is an unauthenticated file upload weakness in the Magento REST API. It lets attackers upload harmful files without needing to log in.
Attack Mechanism: The vulnerability allows attackers to upload files encoded in base64 format through REST API endpoints without proper validation.
Example attack workflow:
POST /rest/V1/products
Content-Type: application/json
Malicious payload example:
{
“file”: “base64_encoded_payload”
}
If server-side validation is misconfigured, the uploaded payload can be written to the filesystem.
Ongoing use of Magento flaw has allowed attackers to upload harmful scripts, keep access to the server, and change website content without permission.
Incident Response Measures:
Immediate actions should be to take away any unauthorized files (like gc.txt, uname.txt). Next, check the whole file system for any problems. Look at web server logs for any strange activity and scan the systems carefully for hidden web shells or backdoors.
Application Security Measures:
All Magento setups need to be updated with the newest security fixes. Unused REST API endpoints should be turned off to lower the risk of attacks. Companies must apply strong checks on file uploads and limit write access in web-accessible folders.
