An exposed staging server at 96.126.130.81 revealed an operator's extortion campaign targeting Japanese real estate websites between October 9-11, 2026, followed by PHP2Shell exploitation tooling. The operator, using the handle kkkkevin777, compromised one Japanese real estate services company and pivoted to nearly 20 related sites through shared hosting credentials. Stolen data included 16,061 customer records with plaintext passwords, income details, and addresses. The operator deployed ransom pages with an October 11 deadline and pressured victims by threatening to expose customer data. PHP2Shell tooling arrived on October 21, ten days after the extortion wave, indicating the operator was preparing new capabilities. Additionally, databases and emails from a Taiwanese company were exfiltrated. The server contained weaponized PHP2Shell reproducers, web shells, beacon logs, and scripts for lateral movement, though no confirmed PHP2Shell exploitation against live targets was documented.
