--- title: Determined Attacker Uploads Malicious Webshells to Parks... description: Huntress SOC researchers detail a multi-week intrusion campaign against a shared recreation management software platform used by municipalities. A threat actor... canonical: https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers | daily.dev og:description: Huntress SOC researchers detail a multi-week intrusion campaign against a shared recreation management software platform used by municipalities. A threat actor... og:url: https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm og:image: https://api.daily.dev/og/posts/HIfPsNtmM.png og:image:alt: Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 12 min read · 10 upvotes · 1 comments ## Summary Huntress SOC researchers detail a multi-week intrusion campaign against a shared recreation management software platform used by municipalities. A threat actor exploited a file upload flaw by registering legitimate member accounts and uploading malicious .aspx webshells, compromising three web servers across four escalating phases. The attacker progressed from noisy, scattergun exploitation attempts (brute force, IIS tilde enumeration, WebDAV abuse) to quiet reconnaissance, then stealthy persistence with timestomping, and finally deployed a trojanized jQuery file to turn site visitors' browsers into WebRTC/WebSocket C2 clients for credential harvesting. The goal throughout was locating and exfiltrating cardholder data from Fortis and MxMerchant payment integrations. Evidence, including a Simplified Chinese locale string and AI-generated script comments, suggests the attacker may be based in China and used AI tooling to accelerate both initial brute-force attempts and later PowerShell payload planting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers get webshells onto the recreation management platform's servers without authentication bypass? They registered legitimate member accounts on the platform and abused a file upload vulnerability to upload malicious .aspx files directly to the /documents/MemberFiles/ directory. After brute force, IIS tilde enumeration, and WebDAV method abuse all failed, simply registering an account and exploiting the upload handler succeeded, since .jpg and .pdf uploads were tested alongside .aspx files that executed commands. _Teams hardening upload handlers can track real-world webshell intrusion patterns like this on daily.dev._ ### What is timestomping and how was it used in a webshell attack to evade detection? Timestomping is manipulating a file's last modified, last accessed, and creation timestamps so a malicious file blends in with legitimate ones. In this intrusion, the attacker used PowerShell to copy the metadata from a legitimate web.config file onto renamed webshells, making them appear to have existed alongside genuine site components and harder to flag during forensic timeline review. _Incident responders refining forensic timeline checks can follow anti-forensics techniques like timestomping on daily.dev._ ### How did attackers turn a compromised web server into a browser-based C2 against site visitors? They injected a trojanized jQuery file (jquery.mousewheel-3.0.6.pack.js) loaded by the authentication page, which pulled a secondary agent from a Cloudflare Workers-hosted script and established WebRTC and WebSocket channels to attacker infrastructure. This converted every visitor's browser into an encrypted C2 client capable of pushing dynamic eval() frames and harvesting credentials in real time. _Developers investigating supply-chain style JS injection attacks can follow similar C2 techniques on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@vithonch** · 0 upvotes > or it wos russain using qwen ^^ this model randomly speak chinese... ## Similar posts on daily.dev - [Threat Actors Achieve Persistence After SQL Injection](https://daily.dev/posts/threat-actors-achieve-persistence-after-sql-injection-cpfwbidol) · Huntress Blog · 5 upvotes · 0 comments - [Crooks compromise WordPress sites, spread infostealers](https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup) · The Register · 0 upvotes · 0 comments - [Attackers Are Hunting High-Impact Node.js Maintainers in a C...](https://daily.dev/posts/attackers-are-hunting-high-impact-node-js-maintainers-in-a-c--qbjm8nm0c) · Socket · 14 upvotes · 2 comments - [Chinese hackers exploit WordPress, Zyxel flaws to steal govt data](https://daily.dev/posts/chinese-hackers-exploit-wordpress-zyxel-flaws-to-steal-govt-data-jkphfeoky) · BleepingComputer · 0 upvotes · 0 comments - [Defence Impairment Olympics](https://daily.dev/posts/defence-impairment-olympics-rkaoi7ndj) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net) [View this post on daily.dev](https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers","url":"https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm"},"datePublished":"2026-10-01T02:54:15.581Z","dateModified":"2026-10-01T02:54:48.667Z","description":"Huntress SOC researchers detail a multi-week intrusion campaign against a shared recreation management software platform used by municipalities. A threat actor...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a52dc6700f15cc392d8ae449b74d40d1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a52dc6700f15cc392d8ae449b74d40d1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":".net","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm","comment":[{"@type":"Comment","text":"or it wos russain using qwen ^^ this model randomly speak chinese…","datePublished":"2026-10-04T18:06:10.408Z","dateModified":"2026-10-04T18:06:36.339Z","url":"https://daily.dev/posts/HIfPsNtmM#c-iRlFs0CVe","author":{"@type":"Person","name":"Vitalii Honcharenko","url":"https://daily.dev/vithonch","image":"https://avatars.githubusercontent.com/u/4058803?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers-hifpsntmm#faq","mainEntity":[{"@type":"Question","name":"How did attackers get webshells onto the recreation management platform's servers without authentication bypass?","acceptedAnswer":{"@type":"Answer","text":"They registered legitimate member accounts on the platform and abused a file upload vulnerability to upload malicious .aspx files directly to the /documents/MemberFiles/ directory. After brute force, IIS tilde enumeration, and WebDAV method abuse all failed, simply registering an account and exploiting the upload handler succeeded, since .jpg and .pdf uploads were tested alongside .aspx files that executed commands. Teams hardening upload handlers can track real-world webshell intrusion patterns like this on daily.dev."}},{"@type":"Question","name":"What is timestomping and how was it used in a webshell attack to evade detection?","acceptedAnswer":{"@type":"Answer","text":"Timestomping is manipulating a file's last modified, last accessed, and creation timestamps so a malicious file blends in with legitimate ones. In this intrusion, the attacker used PowerShell to copy the metadata from a legitimate web.config file onto renamed webshells, making them appear to have existed alongside genuine site components and harder to flag during forensic timeline review. Incident responders refining forensic timeline checks can follow anti-forensics techniques like timestomping on daily.dev."}},{"@type":"Question","name":"How did attackers turn a compromised web server into a browser-based C2 against site visitors?","acceptedAnswer":{"@type":"Answer","text":"They injected a trojanized jQuery file (jquery.mousewheel-3.0.6.pack.js) loaded by the authentication page, which pulled a secondary agent from a Cloudflare Workers-hosted script and established WebRTC and WebSocket channels to attacker infrastructure. This converted every visitor's browser into an encrypted C2 client capable of pushing dynamic eval() frames and harvesting credentials in real time. Developers investigating supply-chain style JS injection attacks can follow similar C2 techniques on daily.dev."}}]} ```