One Host, Six Operations: How Two Open Directories Exposed a Multi-Target Campaign

Hunt.io Attack Capture™↗ (opens in a new tab) flagged two open directories at IP Address "69.48.228[.]86" on port 80 (August 14) and on port 9001 (August 24), ten days apart in August 2026.

A full inventory of both directories reveals a single operator running six parallel operations such as fraud against roughly 2,500 self-hosted "New API" LLM-reseller gateways, LLM-assisted mapping of Vietnam's government and military hierarchy, password-spraying and reconnaissance against Pakistan's National Defence University and armed forces, SQL-injection probing of the Chinese social platform uu-chatroom.com, opportunistic census-style scanning of unrelated hosting-provider IP ranges, and one completed database breach of commercial targets in Mexico.

Let's walk through what was recovered.

Key Findings

• Hunt.io tracked two open directories on ports 80 and 9001 at 69.48.228[.]86 (Singapore, BL Networks, AS399629) running six distinct operations.

• Almost ~2,500 self-hosted New API gateways targeted worldwide via a forged Stripe webhook, with 2 confirmed successful frauds.

• A live API key stolen from one compromised gateway (gpt-5.6-sol) was reused as the operator's own LLM backend for a separate project.

• Vietnam: FOFA-style asset exports were mapped by LLM to specific government and defence entities, including military commands, defence industry, police, ASEAN defence portals, and Viettel subsidiaries.

• Pakistan: Moodle password-spray (108 credential pairs) against flp.ndu.edu.pk; mass OneForAll/massdns subdomain enumeration (1.7M+ candidates/run) against paknavy.gov.pk and pmsa.gov.pk.

• Mexico: Completed SQLi + web-shell compromise of an Azure-hosted billing/restaurant platform. Credentials extracted from four databases; Tomcat Manager access attempted.

• Chinese platform: sqlmap/nuclei runs against uu-chatroom.com's NICKNAME parameter.

• Full-subnet fscan/httpx sweeps of two unrelated hosting ranges (194.163.144.0/24, 78.128.43.0/24: fingerprinted for Barsy CMS), plus an internal 10.0.0.0/24 LAN pivot via the operator's own SOCKS5 proxy.

• 14 data-center cooling/thermal-management companies enumerated via acquired-subsidiary domains.

• One SSH key (summadeus@DESKTOP-VD5TFRQ) is authorized across every capture; a chisel Windows tunnel implant ties persistence to 69.48.228.86:443; a hardcoded password, a renamed binary, and a test file all share the alias "Miku".

Host Infrastructure and Tunneling

Hunt.io shows 69.48.228[.]86↗ (opens in a new tab) under BL Networks (AS399629), geolocated to Singapore, with two warnings on record for potentially malicious open directories, one dated 2026-08-24 and the other 2026-08-14.

The port 80↗ (opens in a new tab) directory was captured on 2026-08-14 and listed as 207 files across 12 subdirectories, totalling 132 MB.

The port 9001↗ (opens in a new tab) directory was captured on 2026-08-24 and listed as 10,538 files across 359 subdirectories, totalling 468 MB.

Shared Proxy and Tunneling Infrastructure

Every operation conducted from this host appears to rely on the same proxy-and-tunnel infrastructure. A rotating pool of tens of thousands of public SOCKS5, HTTP, and HTTPS proxies, including the 31,552 entries in 代理IP.txt ("Proxy IP.txt"), is managed through glider↗ (opens in a new tab), with five separate configurations supporting different listener ports and protocols.

A dedicated maintenance toolkit keeps these pools operational: build_conn_pool.py and build_http_plain.py construct fresh proxy pools, freshen_socks5.py re-probes SOCKS5 endpoints for liveness, prune.py removes proxies that fail live protocol classification, and verify3.py randomly samples each protocol class to verify that the proxies still match their expected protocol.

Note: Scanning, password spraying, and injection activity described throughout this report is routed through this shared proxy fabric.

For persistent access after a foothold is obtained, the operator uses a chisel based Windows tunneling setup. The shell.bat script automates the installation and persistence of this access mechanism.

The script first terminates any existing ch.exe and chisel.exe processes, then downloads chisel.exe from 69.48.228.86 using certutil and saves it as C:\windows\temp\ch.exe. It also retrieves shell.ps1, which provides the bind shell.

The script creates two Windows Scheduled Tasks running as SYSTEM with the highest privileges. The Shell task executes shell.ps1 with PowerShell execution-policy bypass and a hidden window, while the Tunnel task launches the chisel client and establishes a reverse tunnel to 69.48.228.86:443. The tunnel exposes both a SOCKS proxy on 127.0.0.1:1080 and the local bind shell on 127.0.0.1:4444.

The chisel connection uses the hardcoded authentication string Miku.....(redacted), providing the operator with persistent remote access and a SOCKS-based pivoting channel.

The identity link across every capture of this host is a single SSH public key, summadeus@DESKTOP-VD5TFRQ, present in .ssh/authorized_keys in every directory recovered.

Mass Fraud Against Self-Hosted LLM API Gateways Worldwide

One documented activity on this host involves financially motivated fraud targeting self-hosted deployments of “New API”, an open-source LLM proxy and reseller gateway commonly exposed on port 3000. The file 3000.txt contains roughly 2,500 candidate targets worldwide, apparently collected through prior internet-wide scanning.

test_api.py implements an automated exploitation chain against exposed New API instances. It first identifies hosts with a reachable /api/user/login endpoint, then probes a set of candidate Stripe webhook paths using a synthetic checkout.session.completed event. For hosts with a responsive webhook, it authenticates using the hardcoded credential, retrieves or creates a pending payment order, and submits a forged Stripe event signed with an HMAC generated from an empty secret.

The script then checks whether the transaction is marked as paid or the user's quota increases. Separately, it sends a DELETE request to /api/user/1/reset_passkey to test whether the authenticated account can reset or remove the passkey for user ID 1, which the script treats as a high-privilege account.

ulneurls.txt lists 330+ targets confirmed to accept the webhook probe, whereas succeaccounts.txt records two confirmed successful outcomes, inflating account quotas to 50,008,843 and 365,500,000, respectively.

Mapping Vietnam's Government and Military Infrastructure

classify_assets.py reads a bulk FOFA-style export of Vietnamese internet assets (原始.csv), concurrently fetches each URL's page <title>, and classifies every asset into one of eight categories using an extensive set of Vietnamese-language keyword and subdomain-prefix rules:

• Military/Defense
• Police/Judicial
• Party/Party-media
• Medical/CDC
• Education
• Diplomatic
• Government/Administrative
• Enterprise

dept/classify_dept.py crawls each target's homepage, extracts its visible text, and submits that content to an OpenAI-compatible LLM gateway for classification. The model is restricted to a whitelist of Vietnamese government, party, and commercial entities and is instructed to return the institution's Vietnamese name, Chinese translation, hierarchy level, parent organization, category, reasoning, and confidence score.

The script is configured to use http://38.246.232.11:3000/v1 with the gpt-5.6-sol model.

The output accurately identified Vietnamese defence, military, government, and healthcare infrastructure, including provincial military commands, Factory Z127, Military Region newspapers, ASEAN defence portals, national police, party media, provincial health networks, local authorities, and Viettel with its Peruvian and Laotian subsidiaries.

No exploitation was recovered against any classified site.

Pakistan: Credential Spraying and Military Infrastructure Reconnaissance

moodle_spray.py automates credential spraying against Moodle login portals. For each username and password pair, it creates a separate session, retrieves the Moodle logintoken CSRF token from /login/index.php, and submits the credentials. Login attempts can be routed through a SOCKS5 or HTTP proxy, with configurable concurrency and retries. The script identifies successful authentication based on redirects away from the login page or indicators of an authenticated session, then saves any valid credentials to an output file. The implementation was configured to target flp.ndu.edu.pk and supports testing large credential lists through concurrent requests.

Two files, creds_pairs.txt (108 pairs) and retry_pairs.txt (77 pairs), hold username:password combinations for 82 unique ndu.edu.pk (National Defence University) accounts. spray.log records 31 clean failures, 77 proxy-layer failures, and 0 confirmed successes.

Moreover, a targets/domains.txt lists eight primary Pakistani targets:

• paknavy.gov.pk
• pmsa.gov.pk
• pmad.gov.pk
• mod.gov.pk
• caapakistan.com.pk
• surveyofpakistan.gov.pk
• fgei.gov.pk
• ispr.gov.pk

OneForAll drives passive-source queries and massdns brute-forcing, generating over 1.7 million candidate subdomains per run against paknavy.gov.pk and pmsa.gov.pk alone.

SQL Injection Against a National Counter Terrorism Authority (NACTA) e-Learning Portal

A nuclei fingerprinting pass against the nacta.gov.pk e-learning portal identified WordPress 6.4.3 with the BuddyBoss Platform/LearnDash plugin stack, several outdated components, exposed wp-content/wp-includes directory listings, and a disclosed nacta-admin username through the WordPress REST API.

With the plugin stack identified, the operator made three separate sqlmap attempts against the same BuddyBoss members REST endpoint over the following hour, escalating each time:

Separately, the operator obtained a live, Cloudflare cleared session (cf_clearance, laravel_session, XSRF-TOKEN) for hrms.fgei.gov.pk, the HR system for Pakistan's Fauji/Cantonment education network, and replayed it to run an authenticated nuclei scan that flagged an end-of-life Laravel release.

Note: No evidence in the recovered files confirms successful SQL-injection extraction or unauthorized data access at either NACTA or FGEI.

Mexico: SQL Injection, Credential Extraction, and Web-Shell Access

The operator's activity against softwarehubmx1.uksouth.cloudapp.azure.com, a UK South Azure-hosted server tied to a Mexican software vendor (SoftwareHub MX), shows a complete, multi-stage compromise, not just reconnaissance. Two scripts, extract_v2.py and final_shell.py, cover the SQL-injection and post-exploitation stages, respectively.

SQL Injection and Credential Extraction

extract_v2.py automates post-compromise enumeration and credential extraction against a business application hosted at softwarehubmx1.uksouth.cloudapp.azure.com. Its primary function abuses the /api/Sesion/ConsultarSesion endpoint with a UNION-based SQL injection to query information_schema and extract username:password pairs from multiple databases, including facturacion3, facturacion4, facturacionr, and argmons2020.

The script's own comments also record credentials the operator had already confirmed working in an earlier session, for a separate REST API on the same infrastructure:

Tomcat Manager Brute-Forcing and Web Shell Post-Exploitation

The script then performs deeper reconnaissance against a Tomcat service on port 8080, probing manager endpoints, testing common credentials, and checking for deployed applications using database and application names as paths. It also inspects the HTTP service on port 80 and tests extracted credentials against multiple authentication endpoints on port 9099. The script ultimately consolidates discovered credentials and identifies accounts that successfully authenticate to the exposed applications.

final_shell.py picks up from an already-deployed JSP web shell (exec_shell.jsp) on the Tomcat instance, confirming code execution was already established by the time this script ran. It uses the shell to:

• Check whether PowerShell is available and where it's located.
• Test writing files under the Tomcat webroot to probe whether Windows Defender is intercepting dropped files.
• Query Windows Defender's service state directly (sc query WinDefend).
• Re-test a recovered Tomcat Manager credential pair in three encoding variants.
• Pull CATALINA_HOME/CATALINA_BASE, running Java processes, full systeminfo output, and ipconfig /all, standard host and network fingerprinting once code execution is confirmed.

Dump Records

A standalone file, argmons2020_users.txt, contains 37 username:password pairs that closely match the output expected from extract_v2.py when querying argmons2020.tb_user2. The script itself labels this extraction step argmons2020.tb_user2 (cleartext!), directly indicating that it was designed to extract cleartext credentials from that table.

This provides independent corroborating evidence within the recovered dataset that the SQLi technique succeeded against this server.

Other Targets

Reconnaissance of Data-Center Cooling Companies

A targets/ folder holds subdomain enumeration labeled by company name, resolving to real corporate or subsidiary domains, several of them acquired brands:

No exploitation scripts or credential lists were recovered for these targets; only OneForAll style enumeration and liveness checks were found.

SQL Injection Testing Against a Chinese Social Platform

.bash_history shows the operator building and running raw HTTP request files (uu_sign_in, uu_search1) against www.uu-chatroom.com, a Chinese-language social/dating chatroom platform, through sqlmap:

sqlmap -r uu_sign_in --random-agent --batch --log-file uu_sign_in_result.txt
sqlmap -r uu_search1 --random-agent --batch -p "NICKNAME" --level 2 --risk 2

The NICKNAME parameter on the platform's search function was manually selected as the injection point, with --level 2 --risk 2 used to broaden sqlmap's payload set after an initial pass with default settings. A parallel nuclei scan (nohup nuclei -u "http://www.uu-chatroom.com/" -pt http -s info,high,critical ...) was run through the same proxy pool.

No result files, extracted data, or sqlmap "identified injection point" output were recovered for this target.

The operator's own cleanup command (rm miku_scan.exe uu_scan_result.txt uu_sign_in run.log ra583_test1.txt) removed most of the working files afterward.

Additional Network Scanning and an Internal Pivot

Beyond the named targets, bash history and scan output show broad scanning of unrelated infrastructure:

• 194.163.144.0/24: A full-range fscan sweep (fscan -h 194.163.144.0/24 -f txt -o c段.txt) followed by httpx-style fingerprinting identified 200+ servers in a shared-hosting/VPS subnet, including Nginx Proxy Manager, CapRover, Easypanel, Cloudron, phpMyAdmin, MinIO, WordPress, Drupal, Moodle, Odoo, Next.js, and exposed MySQL, MariaDB, and Redis services.

• 78.128.43.0/24: ffuf content fuzzing targeted 78.128.43.21 and 78.128.43.31 with PHP and generic-path wordlists, followed by a nuclei scan tagged for Barsy, indicating focused fingerprinting of sites using the Barsy website-builder platform.

• Internal 10.0.0.0/24 LAN: Traffic was routed through the local SOCKS5 proxy using curl -x socks5://127.0.0.1:1080 and fscan ... -socks5 127.0.0.1:1080. The scan identified a Windows host named ServidorSoftwar ("Software Server") running IIS, Tomcat, and XAMPP.

Other one-off nmap scans targeted hosts in South Korea, Malaysia, Liberia, and Vietnam-registered infrastructure (210.245.107.5), with no corresponding result files, suggesting routine reconnaissance rather than dedicated operations.

Operator Assessment

Both directories contain extensive Chinese-language code comments and console output, consistent in style and terminology across the Moodle-spraying, proxy-pool, and SQL-injection tooling.

The use of OneForAll and fscan, both Chinese-origin tools, together with Chinese-language comments across unrelated projects, is consistent with a Chinese-speaking operator.

A recurring alias, "Miku", appears across artifacts such as the hardcoded chisel tunnel password Miku...., an fscan binary renamed to miku_scan/miku_scan.exe before being served from the operator's HTTP file server, and the empty test file mikumikumiku.bat.

The shared summadeus@DESKTOP-VD5TFRQ SSH key exposes the same operator environment.

Mitigations

• Enforce multi-factor authentication on Moodle, WordPress, and other staff/student login portals.

• Configure and validate payment-webhook signing secrets; never leave them empty or optional.

• Patch outdated CMS/plugin stacks (BuddyBoss, Laravel, LearnDash) on a fixed schedule.

• Rotate cf_clearance, session cookies, and API keys immediately if exposure is suspected.

• Monitor for chisel-style reverse tunnels and Scheduled Tasks with generic names (Shell, Tunnel).

Conclusion

The two open directories on 69.48.228[.]86 show how the operator organized and reused the same infrastructure across several operations. The recovered files show activity ranging from password spraying and subdomain enumeration against Pakistani government and defence organizations to reconnaissance of Vietnamese infrastructure and attacks against exposed web applications.

The New API fraud campaign and the scans against uu-chatroom.com and NACTA show the operator moving between different targets and techniques while relying on the same proxy and tunneling setup.

The shared SSH key, chisel infrastructure, proxy tooling, and recurring "Miku" identifier help tie the captures together.

MITRE ATT&CK Mapping

Indicators of Compromise

Network infrastructure

Files, hashes, and identifiers