Researchers from DataDog Security Labs have uncovered a significant campaign where threat actors exploit vulnerabilities in NGINX servers. This campaign involves redirecting user traffic through the attackers' own infrastructure without raising security alarms.
The malicious activity primarily targets NGINX installations and Baota hosting management panels, specifically for websites with Asian top-level domains such as .in, .id, and .th, along with educational and governmental sites like .edu and .gov. Attackers inject harmful configuration changes into existing NGINX files, capturing and rerouting user requests through their domains.
The operation employs a sophisticated multi-stage toolkit that executes various tasks, including modifying configuration files and ensuring service continuity. By preserving request headers, the compromised traffic is made to look legitimate, which complicates detection efforts.