Overview
Security researchers demonstrated how abandoned infrastructure enabled the hijacking of 4,000+ web backdoors through the registration of 40+ expired domains for just minimal investment of $20 per domain. The operation exposed critical vulnerabilities
Whom it may concern
- Government cybersecurity teams
- Academic institution IT departments
- Domain registration authorities
- Security operations teams
Key Findings
- Compromised systems included institutions from Bangladesh, China, Nigeria, South Korea, and Thailand
- Successfully sinkholed malicious domains in partnership with Shadowserver Foundation
- Identified multiple backdoor variants:
* Simple PHP web shells
* c99shell
* r57shell
* China Chopper
Risk Analysis
- Critical exposure of government and academic systems
- Probability: High (demonstrated successful exploitation)
- Impact: Severe (potential unauthorized system access)
- Attack complexity: Low (minimal cost and technical barriers)
Action Items
- Implement domain expiration monitoring
- Deploy web shell detection systems
- Establish infrastructure decommissioning protocols
- Conduct regular domain inventory audits
Sources
- [The Hacker News](https://thehackernews.com/2025/01/expired-domains-allowed-control-over.html)
