This campaign involves an attack server staging multiple exploits, including recent CVEs such as NGINX Rift (CVE-2026-42945) and Ghost CMS (CVE-2026-26980), alongside older vulnerabilities like a 2017 WebLogic bug and a recently disclosed Splunk RCE. The server was found on a Singapore VPS and was used both to stage exploits and receive reverse shells. Targets are curated and organized by country and sector, focusing on government, universities, healthcare, and financial services across 11 countries. The presence of an AdaptixC2 server indicates active command and control capabilities. The information is sourced from a Reddit post linking to a detailed blog by hunt.io.

The campaign targets critical sectors including government, healthcare, universities, and financial services in multiple countries, potentially enabling unauthorized access and control via exploitation of known vulnerabilities. The use of recent CVEs suggests attackers are leveraging fresh exploits, increasing risk to unpatched systems. The presence of a command and control server indicates potential for ongoing compromise and lateral movement within victim networks.

Patch status for the involved vulnerabilities (CVE-2026-42945, CVE-2026-26980, and others) is not confirmed in this data; check vendor advisories for each CVE for current remediation guidance. Organizations in targeted sectors should verify that systems are updated against these vulnerabilities. Since the campaign uses known exploits, applying official patches and security updates for WebLogic, Splunk, NGINX Rift, and Ghost CMS is recommended. Monitor for indicators of compromise related to AdaptixC2 activity. No vendor advisory or official fix status is provided here, so patch status is not yet confirmed.