Analysis of Multi-Stage Attack Infrastructure Targeting Defense, Security, and Government Organizations in the United States and Asia
By Threat Intelligence Unit
Overview
Oasis Security analyzed files collected from an attacker server used in multiple attacks, including reconnaissance, vulnerability exploitation, SSRF, session exfiltration, and credential brute-forcing, against infrastructure associated with [Victim A], a U.S. government-funded research institute. A total of 1,665 documents related to applicants to [Victim B], an Indo-Pacific security research institute, were also identified on the server. The files also showed attacks against Malaysian government institutions and public services.
Executive Summary
- Files were collected from 192.3.239.164 (United States)
- [Victim A]: reconnaissance with nmap and nuclei, followed by automated Blind SSRF through a vulnerable function of d[Victim A].org. Data accessed via SSRF is assessed to have been stored in blind form in the victim service database; no payloads confirming exfiltration of original sensitive data to the attacker's external VPS were identified
- [Victim B]: 1,665 applicant documents containing full names, contact details, education and majors, work experience, signatures, and passports. How the documents were obtained has not been established
- Malaysian government: vulnerability scanning of 51 domains, 88 phpMyAdmin session-exfiltration attempts, and 1,616 credential brute-force attempts, with no evidence of success
Infrastructure Analysis
- IP Address: 192.3.239.164
- Geolocation: United States
Analysis of the collected files confirmed that the primary target was infrastructure associated with [Victim A].
Figure 1. [Victim A] certificate and export directories, including SSRF, callback, and scan files
In addition, 1,665 applicant-related files from [Victim B] were identified.
Figure 2. [Victim B] applicant archives, including _personal, _pdfs, _CV, and _sensitive
[Victim A]: Blind SSRF Against a U.S. Government-Funded Research Institute
The attacker used SSRF (Server-Side Request Forgery) against [Victim A], and evidence of access to internal resources and credentials was identified. However, no indication was confirmed that the data was actually exfiltrated to the attacker's server.
| Data / Target | Identified scope and assessment |
|---|---|
| Django application configuration | Access to /app/settings.py, /app/.env, docker-compose.yml, Dockerfile, manage.py, urls.py, and others. Targets included the Django SECRET_KEY, DB passwords, and application configuration |
| SSH credentials | Access to /root/.ssh/id_rsa. SSH private keys were among the SSRF read targets, with related callbacks from 4 Pods |
| AWS credentials and metadata | Access to /root/.aws/credentials and AWS IMDS. IAM credential information was among the access targets |
| Kubernetes credentials | Access to /root/.kube/config, /var/run/secrets/.../token, and kubernetes.default.svc. Cluster configuration and Service Account tokens were among the access targets |
| System and container information | Access to /etc/shadow, /proc/self/environ, /etc/nginx/nginx.conf, and others. Password hashes, container environment variables, and Nginx configuration were among the access targets |
| Internal services | Internal access indications to Redis (6379), PostgreSQL (5432), Django Admin (8000), and others |
| [Victim A] certificates | Access or download indications for 4 certificates |
| Blind stored data | Information accessed via SSRF was stored as link-summary metadata in the d[Victim A].org knowledge-base DB; no data exfiltrated to the attacker VPS was collected |
| DNS rebinding and port scan | Access attempts to the admin login page and the 169.254.169.254 metadata area. 41 events (26 PORT_SCAN_HIT, 15 PORT_HIT), with no evidence of additional exfiltration |
The attacker's primary activities against [Victim A] infrastructure and the related evidence files are as follows.
| Activity | Evidence file |
|---|---|
| Full port scan of [Victim A] ranges | nmap_[Victim A]_full.txt |
| Selective port scan of [Victim A] ranges | nmap_226_229, nmap_230_255, nmap_sma_range |
| Blind SSRF requests and successful responses | auto_ssrf.log and related .sh and cookie files |
| Callback infrastructure setup | ssrf_proxy*.py, ssrf_v4_exfil.py |
| SSRF channel established | ssrf_log.txt |
| Access to sensitive files and blind storage | ALL_CALLBACKS.log, SSRF_FILE_READ_SUMMARY.txt |
| DNS rebinding attempt | ssrf_catcher.log (rebind_test, rebind_err) |
| Internal port scan of ssrf_v3_server2.py | ssrf_catcher.log (26 PORT_SCAN_HIT, 15 PORT_HIT) |
SSRF_FILE_READ_SUMMARY.txt lists the following files and paths targeted for access and collection.
| Category | Target file / path | Information |
|---|---|---|
| Django configuration | /app/settings.py | Django SECRET_KEY, DB password |
| SSH | /root/.ssh/id_rsa | SSH private key |
| AWS | /root/.aws/credentials | AWS IAM credentials |
| Kubernetes | /root/.kube/config | Kubernetes cluster configuration |
| K8s Service Account | /var/run/secrets/.../token, /namespace | Account token and namespace |
| System information | /proc/self/environ, /proc/self/cmdline, /proc/1/cgroup, /proc/self/mountinfo | Process and container environment |
| Application files | docker-compose.yml, .env, manage.py, requirements.txt, d/urls.py | Environment variables, deployment configuration, source-related information |
| System configuration | /etc/nginx/nginx.conf, /etc/shadow | Nginx configuration and password hashes |
The following internal services and data were also associated with access indications during the attack.
| Category | Target | Details |
|---|---|---|
| AWS metadata | 169.254.169.254 | /user-data, /meta-data/hostname, /meta-data/local-ipv4, /latest/meta-data/iam/security-credentials/, and others; accessed from 4 Pods |
| Kubernetes API | kubernetes.default.svc | /api/v1/namespaces/default/secrets, /pods |
| Internal services | 4 Pods | 127.0.0.1:6379 (Redis), 8000/admin (Django Admin), Django users API (307), 5432 (PostgreSQL), debug-404-test, and others |
| Public certificates | gallery.[Victim A].org | 4 public certificate downloads |
Reconnaissance
nmap_[Victim A]_full.txt and nmap_sma_range.txt show port and service scanning against network ranges associated with [Victim A].
Blind SSRF
The auto_ssrf.log file records more than 60 successfully submitted requests targeting the knowledgebaseform function of d[Victim A].org.
Figure 3. Log entries showing successful submission of SSRF requests
The auto_ssrf() function in [Victim A]_attack.py obtained a CSRF token from the knowledgebaseform function and submitted values in the form of link_url=/{name} to automate SSRF requests.
Figure 4. auto_ssrf() obtaining a CSRF token and submitting SSRF requests
Callback Infrastructure
ssrf_proxy.py, ssrf_v4_exfil.py, and related scripts set up callback servers to receive backend requests from the victim server.
Figure 5. Callback handler saving incoming data to /tmp/exfil
The attacker built attack and callback mechanisms using DNS, FTP, Gopher, and Dict protocols, as well as DNS rebinding.
Figure 6. Redirect targets covering FTP, Gopher, Dict, AWS metadata, DNS, Kubernetes, and Django endpoints
On 29 July 2026, a callback was received at the /ssrf-test endpoint with an HTTP 200 response. This suggests an SSRF channel from the victim server to the attacker's callback server was established at that time.
Access to Sensitive Resources
ALL_CALLBACKS.log records GET requests from backend Pods associated with d[Victim A].org to attacker-controlled callback paths such as /ssh-root, /aws-creds, /kube-config, and /shadow. The IP addresses shown in the log are the observed source IPs of the victim-side requests, rather than the address of the attacker’s callback server. The attacker configured those paths to return HTTP 302 redirects to sensitive file:// paths on the victim-side local filesystem.
Figure 7. ALL_CALLBACKS.log callbacks for SSH, AWS, Kubernetes, and shadow paths
SSRF_FILE_READ_SUMMARY.txt contains 18 file-read records, 4 AWS metadata access records, 7 other internal-service access records, 91 records related to backend Pod IPs, and 4 records related to CA public certificates. The results were stored in blind form in the metadata of the victim service database.
Figure 8. File paths and callback counts in SSRF_FILE_READ_SUMMARY.txt
DNS Rebinding and Internal Port Scan
To exfiltrate files, the attacker attempted to access internal resources using DNS rebinding around 10:33 on 3 September, 2026.
Figure 9. DNS rebinding and metadata access attempts logged as failed fetches
Initial direct attempts to access metadata were logged as NetworkError. Later bypass attempts using nip.io showed indications of access to internal resources, but the callback logs contained only the NIP_IMG_HIT marker, with no responses or payloads containing original data.
Figure 10. NIP_IMG_HIT and PORT_SCAN_HIT events via nip.io
An internal port scan of ssrf_v3_server2.py followed, with 41 access and scanning events, including 26 PORT_SCAN_HIT and 15 PORT_HIT records. All requests were recorded with size=0 and dur=0, so no additional data is assessed to have been exfiltrated to the attacker's external VPS during the scan.
Figure 11. Internal port scan of ssrf_v3_server2.py recorded in ssrf_catcher.log
[Victim B]: Applicant Documents from an Indo-Pacific Security Research Institute
A total of 1,665 applicant documents related to [Victim B] were identified: 542 in [Victim B]_personal, 8 in [Victim B]_sensitive, 633 in [Victim B]_pdfs, and 482 in [Victim B]_CV. The available evidence does not establish how these documents were obtained or what attack activity, if any, was involved.
Figure 12. Redacted [Victim B] application documents, including resumes, cover letters, and writing samples
The documents contain applicants' full names, contact details, education and majors, employment histories, signatures, and passport information. Although the acquisition method and initial compromise vector remain unknown, the presence of these documents on attacker infrastructure raises concerns about secondary harm from the exposed information.
Figure 13. Blurred previews of applicant reference letters and a passport scan
Malaysian Government Institutions: Scanning, Session Theft, and Brute Force
Vulnerability scanning logs targeting 51 Malaysian government services were identified on the server.
Figure 14. nuclei scan reports on the attacker server
nuclei_targets.txt lists 51 domains as scan targets: 3 city councils, 6 Ministry of Health services, 11 local councils and local governments, and 31 other government institutions.
Figure 15. Redacted Malaysian government scan targets in nuclei_targets.txt
session_steal.log shows attempted phpMyAdmin session exfiltration against 2 services under a local city council. A total of 88 attempts were identified, with no evidence of a successful session theft.
Figure 16. session_steal.log phpMyAdmin polling with 0 sessions captured
brute_all.log shows credential brute-forcing against an administrator account associated with a local government: 558 attempts against Zimbra, 500 against Drupal, and 558 against Keycloak, for 1,616 in total. No successful authentication was identified.
Figure 17. brute_all.log brute-force results for Zimbra, Drupal, and Keycloak
Conclusion
This analysis covers systematic, automated attacks against defense-related research institutes and government institutions that went beyond vulnerability scanning to target internal resources and sensitive credentials.
The attacker's primary target was infrastructure associated with [Victim A]. After reconnaissance and vulnerability scanning, the attacker used Blind SSRF to reach internal resources on the victim server, targeting SSH private keys, AWS and Kubernetes credentials, Django configuration, and system account information. Follow-on attempts used SSTI, JavaScript, DNS rebinding, and internal port scanning to exfiltrate data to external infrastructure. Because the original credential data was not found on the attacker's external VPS and no real payloads were included in outbound transmissions, file exfiltration cannot be confirmed. However, the attacker has already identified exploitable weaknesses, so further attempts are likely.
For [Victim B], 1,665 documents containing applicants' personal information were identified on the attacker's server, confirming the attacker exfiltrated them. The attack method and the route by which the documents reached the server remain unknown.
Attacks against Malaysian government institutions and public services, including vulnerability scanning, session exfiltration, and credential brute-forcing, were also identified. The analyzed logs show no successful session theft or administrator authentication.