InfoSecBulletin Cybersecurity for mankind
Cyber Threat Intelligence Unit of BGD e-Gov CIRT has found many suspicious files on Bangladesh government infra like gc.txt and uname.txt. Hackers use such files to check unauthorized write access to web servers.
The found artifacts match signs of a big global web defacement campaign that hit Magento systems, first noted on 27 February 2026. This campaign has led to the breach of over 15,000 hostnames from around 7,500 domains globally.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
CIRT found many government infra endpoints with unauthorized files, including gc.txt (defacement claim evidence) and uname.txt (system verification results).
These files typically contain attacker aliases, timestamps, proof-of-compromise messages, and system-level information. Their presence indicates successful exploitation and unauthorized file write access on affected servers.
Attackers commonly use such artifacts to validate intrusions and submit evidence to defacement tracking platforms (e.g., Zone-H).
Technical Root Cause Analysis
The recent campaign is connected to the PolyShell problem (APSB25-94), affecting Magento Open Source and Adobe Commerce platforms.
The flaw is an unauthenticated file upload weakness in the Magento REST API. It lets attackers upload harmful files without needing to log in.
Attack Mechanism: The vulnerability allows attackers to upload files encoded in base64 format through REST API endpoints without proper validation.
Example attack workflow:
POST /rest/V1/products
Content-Type: application/json
Malicious payload example:
{
“file”: “base64_encoded_payload”
}
If server-side validation is misconfigured, the uploaded payload can be written to the filesystem.
Ongoing use of Magento flaw has allowed attackers to upload harmful scripts, keep access to the server, and change website content without permission.
Incident Response Measures:
Immediate actions should be to take away any unauthorized files (like gc.txt, uname.txt). Next, check the whole file system for any problems. Look at web server logs for any strange activity and scan the systems carefully for hidden web shells or backdoors.
Application Security Measures:
All Magento setups need to be updated with the newest security fixes. Unused REST API endpoints should be turned off to lower the risk of attacks. Companies must apply strong checks on file uploads and limit write access in web-accessible folders.
