Evidence · DiggingBeagle record
Unit 42: PHP2Shell exploitation and AI-like post-exploitation at European government
Unit 42 October 23 threat brief records post-exploitation at a European government, theft of authentication material, and command sequencing interpreted as signs of agentic attacker tooling; 22.6 million are potentially exposed instances, not victims.
- Source role
- primary disclosure
Evidence record
Unit 42 October 23 threat brief records post-exploitation at a European government, theft of authentication material, and command sequencing interpreted as signs of agentic attacker tooling; 22.6 million are potentially exposed instances, not victims.
Claim-level citations (7)
- supportsPHP2Shell attackers reached European government credentials with agentic workflow indicators: In the same observed intrusion, attackers established an NTLM relay tunnel into Active Directory and attempted Domain Admin privilege escalation. A successful Domain Admin takeover is not established.
Executive Summary: NTLM relay tunnel and attempted Domain Admin escalation
- supportsPHP2Shell attackers reached European government credentials with agentic workflow indicators: Unit 42 reports that attackers exploited a PHP2Shell-affected European government organization and within two hours accessed password hashes and multifactor-authentication secrets.
Executive Summary: government exploitation and first two hours of post-exploitation
- supportsPHP2Shell attackers reached European government credentials with agentic workflow indicators: Unit 42 interprets short, serially spaced commands, parser-friendly ==SHELLUSER== and ==PASSWD== headers, and rapid pivots after errors as strong indicators of an agentic attack platform; the specific model, controller and degree of human supervision are not identified.
Executive Summary: agentic platform indicators and Figure 1 web shell recon
- supportsPHP2Shell attackers reached European government credentials with agentic workflow indicators: Unit 42 reports a European government intrusion in which attackers reached password hashes and MFA secrets within two hours, set up an NTLM relay tunnel and attempted Domain Admin escalation.
Executive Summary; October 23 agentic post-exploitation update
- supportsPHP2Shell attackers reached European government credentials with agentic workflow indicators: Unit 42 counted over 22.6 million exposed potentially vulnerable instances in exposure telemetry; the count does not establish 22.6 million vulnerable versions or compromised victims.
Executive Summary: Cortex Xpanse identified over 22.6 million exposed instances potentially vulnerable
- supportsPHP2Shell attackers reached European government credentials with agentic workflow indicators: Unit 42 inferred agentic operation from machine-parseable command delimiters and rapid retries; its public evidence does not identify an autonomous model instance or prove that AI selected all actions.
Command delimiters and Cortex XDR trace description
- supportsPHP2Shell attackers reached European government credentials with agentic workflow indicators: The vendor reported over 22.6 million potentially exposed instances in telemetry; that number is not a count of confirmed exploited or verified vulnerable endpoints.
Cortex Xpanse exposed instances metric