Analysis of Cyber Intrusions Targeting Two Major South Korean Churches
By Threat Intelligence Unit
Incident Overview
Oasis Security analyzed files collected from an attacker-controlled server in the United States and identified intrusions against two of South Korea's largest churches. The files were collected between 28 August and 1 September 2026 and contained attack tools, exfiltrated data, and operator reports for both organizations.
The two intrusions used different methods. The first went through a web shell on the church's ERP system. The second used previously leaked credentials and IDOR (Insecure Direct Object Reference) vulnerabilities in groupware and membership systems.
Attack Techniques
In the first intrusion, the attacker uploaded a web shell to the ERP web root and reverse engineered the ERP's Security.dll to decrypt ServerSetting.xml, obtaining MSSQL sysadmin credentials. Using linked-server mappings, the attacker moved to internal database servers and executed xp_cmdshell on each server, gaining SYSTEM-level command execution. The attacker then bypassed a database-monitoring control, recovered the MariaDB root password, and used hardcoded credentials to reach NAS storage.
Collected data was exported, archived, and staged in a MinIO bucket. Credentials from an earlier compromise of a U.S. Christian content platform were reused for this staging infrastructure.
In the second intrusion, the attacker used leaked groupware credentials and IDOR flaws in EKP and SIMS to view other users' plaintext PINs and reset a manager-privileged account. Groupware single sign-on then gave access to the SAP portal without a separate login. Additional reconnaissance identified unauthenticated college-ministry APIs, public GitHub repositories, and Firebase storage rules allowing unrestricted reads and writes.
Impact
From the first church, 47.3 GB across 13,939 files were collected, including congregant records with names and resident registration numbers, donation records, approval documents, and login accounts.
From the second church, personal information for about 89,000 congregants, 286 employee HR records, and 96 employee photographs were collected, along with approval documents and records related to the college ministry.
Recommendations
- Remove unauthorized web shells, rotate exposed passwords and tokens, and invalidate active sessions
- Disable
xp_cmdshellwhere it is not required, and restrict linked-server privileges - Treat credentials found in backups, configuration files, public code, or exposed storage as compromised
- Enforce object-level authorization checks on every request to prevent IDOR, and validate password-reset and SSO permissions
- Review cloud storage rules and monitor ERP, database, NAS, and cloud logs for large exports or unusual access