Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers

What it is

Concrete IOCs and detection artifacts from the Huntress writeup (incident date 2026-09-10) that the catalog summary names but does not reproduce. The entry already establishes the four-act narrative and TTPs; what follows is the material a detection engineer actually needs to act.

Preconditions / Affected

A shared recreation-management platform on IIS where the member file-upload feature writes to /documents/MemberFiles/ and does not block .aspx execution. The attacker registered a legitimate member account, so this is an authenticated-but-unprivileged path — login brute force, IIS 8.3 tilde enumeration, and WebDAV verb abuse all failed first. Upload filenames follow <accountID>_<memberID>_<guid>.<ext>, which let Huntress pivot from a shell filename back to the registering account.

What to do

Webshell filenames — these were copied/masqueraded as legitimate assets across web roots, so hunt for .aspx where these names should only be .js/.css:

• css_bundle.aspx
• jquery.validate.min.aspx (also written query.validate.min.aspx in the post)
• webresource.aspx

Act-4 dropper artifacts in C:\Windows\Temp (staged Base64-first, then decoded):

plant_ccrtc_mousewheel.ps1.b64 / .ps1   (deep recursive scanner)
plant_ccrtc_fast.ps1.ps1.b64   / .ps1   (shallow, EDR-evading variant)
ccrtc_sdk_init.js.b64          / .js

The planter appends an obfuscated dropper into the legitimate jQuery file jquery.mousewheel-3.0.6.pack.js (loaded by /auth/default.aspx), uses an idempotency guard function named _0x9d66 to avoid double-writes, then timestomps the file back to its original UTC times. Grep served jQuery assets for _0x9d66 and for the AI-generated comment strings left in the scripts, e.g. # Fast plant: candidate paths only, no drive recurse. Run ON web host. and # append only - do not rewrite head/structure.

C2 infrastructure (Cloudflare Workers) — block/alert:

hxxps://chat.ririmochii[.]workers[.]dev/core[.]js
hxxps://fk.bubuneeko[.]workers[.]dev/_cf/rel
hxxps://fk.bubuneeko[.]workers[.]dev/_cf/ice
wss://fk.bubuneeko[.]workers[.]dev/_cf/soc

The trojanized jQuery turns any browser hitting /auth/default.aspx into a WebRTC/WebSocket C2 client that receives eval() frames and harvests credentials in real time.

Attribution/hunting string — the PowerShell user agent carrying a Simplified-Chinese locale:

Mozilla/5.0+(Windows+NT;+Windows+NT+10.0;+zh-CN)+WindowsPowerShell/5.1.22621.1037

Behavioral detection: w3wp.exe spawning cmd.exe/powershell.exe is the backbone of every act. High-signal child commands include appcmd.exe list sites|vdirs|app, findstr sweeps for connectionString/CVV/CardNumber/Fortis/AuthorizeNet across E:\Content\..., and reads of _fortis\Webhooks\*.txt / mxmerchant payment directories.

Caveats

The locale string is the sole attribution basis ("most likely based in China") — a user-agent is trivially forgeable. The payment-module persistence drop in Act 3 (css_bundle.aspx into mxmerchant/fortis folders) failed, and the Act-4 webshell re-tasking failed because the files were already remediated — so those paths are hunting ground, not confirmed footholds. Server paths (E:\Content, E:\Websites) and the 12345_67890_ filename prefixes are environment-specific.