Originally published at https://monstermegs.com/blog/compromised-web-servers/
Your website might already be working for someone else. In August 2026, Check Point Research disclosed that a North Korean espionage crew had stopped hosting its own command and control infrastructure and was instead routing operator traffic through compromised web servers owned by ordinary businesses. The relay points were not underground bulletproof hosts. They were compromised web servers running everyday software. They were webmail installs, WordPress sites and PrestaShop stores whose owners had no idea their hosting accounts had been folded into a state sponsored spy campaign aimed at defense and aerospace firms in Europe and India.
The Campaign That Turned Compromised Web Servers Into Infrastructure
The activity is a revival of Operation Dream Job, the long running Lazarus Group campaign that approaches engineers on LinkedIn with fake recruiter messages and elaborate fake hiring portals. What changed in 2026 is the back end. Check Point observed successful exploitation beginning in June 2026, and reported the underlying Windows privilege escalation flaw, CVE-2026-68820 in the AFD.sys WinSock driver, to Microsoft in late July. Microsoft shipped the fix in its August 2026 Patch Tuesday. The zero day got the headlines, but the quieter detail for anyone who runs a website was where the stolen data went: out through compromised web servers that belonged to unrelated third parties.
Sergey Shykevich, director of threat intelligence at Check Point Software, summarized the wider problem bluntly. “When the website, the download and the recruiter all appear authentic, the old advice to ‘spot the phishing link' is no longer easily applicable.” The same logic applies at the network layer. When callback traffic terminates at a legitimate small business domain with clean reputation history, the old advice to block known bad infrastructure stops working too.
RelayShell and the Roundcube Flaw That Opened the Door
The tool that made this possible is a previously undocumented PHP web shell that Check Point named RelayShell. It does not behave like the noisy web shells most administrators have seen. RelayShell does not execute operator commands on the host it sits on. It acts as a mailbox, writing commands and responses into plain text files that the real victim machines poll and answer. The compromised web servers in the chain are couriers, not endpoints, which is exactly why nobody noticed them.
Access to those compromised web servers came from two directions. Many of the affected Roundcube webmail servers were still vulnerable to CVE-2025-49113, a flaw disclosed more than a year earlier and long since patched upstream. Others appear to have been entered with valid credentials bought from dark web markets, which is a reminder that a fully patched control panel is still only as strong as the password behind it. Researchers identified at least 17 compromised web servers carrying RelayShell, a small number that hides a much larger structural problem.
Why File Based Relaying Is So Hard to Spot
Traditional detection looks for outbound connections to strange IP addresses, beaconing intervals, or PHP processes spawning shells. RelayShell generates none of that on the relay host. From the outside, the compromised web servers are just serving HTTP requests and writing files, which is what web servers do all day. Host based scanners tuned to catch reverse shells and cryptominers can walk straight past compromised web servers in this configuration, and traffic analysis at the victim end sees a request to a normal looking website rather than a suspicious foreign endpoint.
The Credential Failure Behind Many Compromised Web Servers
Stolen credentials keep showing up as the entry point, and separate research published the same month explains why the supply never dries up. Truffle Security spent four years cataloging exposed Amazon Web Services credentials and, on 10 August 2026, re-tested 10,616 complete key pairs that had been leaked publicly between August 2022 and August 2026. As BleepingComputer reported, 9,308 of them, roughly 88 percent, still authenticated successfully. Among those, 242 belonged to IAM users holding the AdministratorAccess policy and 526 were root keys.
That is the same failure mode that produces compromised web servers, scaled up to cloud accounts. Secrets get published, nobody rotates them, and years later they still open the door. A hosting control panel password reused on a breached forum in 2023 works exactly the same way in 2026 unless somebody changes it. Attackers do not need a zero day to build a network of compromised web servers when 88 percent of the old keys still work.
Why Attackers Now Prefer Compromised Web Servers
Renting infrastructure is a liability for a threat actor, and compromised web servers remove almost every drawback. Domains get registered, paid for and eventually attributed. Hosting providers respond to abuse reports and pull accounts. Reputation systems flag freshly registered domains within hours. Compromised web servers solve all of those problems at once, because the domain is years old, the certificate is valid, the WHOIS record points at a real company, and the abuse desk has no complaints on file.
There is a second advantage that matters more in targeted espionage than in commodity crime. Defense contractors and aerospace suppliers run outbound filtering. Traffic to an anonymous VPS in an unusual jurisdiction gets questioned. Traffic to a European retailer running PrestaShop does not. The compromised web servers in this campaign were chosen precisely because they look boring, and boring is the most valuable property attacker infrastructure can have.
What It Costs the Site Owner
Site owners caught in this rarely see data theft on their own systems. What they get instead is blocklisting, deliverability collapse when their sending domain lands on a threat feed, and in the worst cases a law enforcement request pointing at their hosting account. Cleanup on compromised web servers means finding a web shell that was designed not to look like one, which is considerably harder than removing a defacement.
Advisories That Landed in the Same Window
The Lazarus disclosure did not arrive in isolation. WordPress published a core security release on 7 August 2026 covering a chain nicknamed XSS2Shell that takes an unauthenticated attacker from a reflected cross site scripting flaw on the login screen to remote code execution, then shipped a second core security release just five days later on 12 August. Around the same date, the Apache Software Foundation released apr-util 1.6.4 to fix two heap buffer overflows, CVE-2026-34501 in the Redis client and CVE-2026-34502 in the memcached client, both of which sit under a great deal of shared hosting.
Read together with the Check Point findings, the pattern behind compromised web servers is clear enough. Remote code execution paths into public facing PHP applications keep appearing, patched credentials keep circulating, and the population of reachable compromised web servers keeps replenishing itself. Our earlier coverage of plugin vulnerability disclosures traced the same cycle through the plugin ecosystem, where the gap between a published fix and an applied one is where most breaches actually live.
How to Tell Whether Your Site Is Being Used
Because RelayShell hides in normal web activity, the checks that separate healthy sites from compromised web servers are unglamorous. Compare your document root against a known good copy or a recent backup and look for PHP files that were modified outside your deployment window, especially in uploads, cache and vendor directories where nobody looks. Watch for unfamiliar plain text files with random names sitting next to legitimate scripts, since the file based messaging pattern leaves them behind. Review access logs for repeated POST requests to a single obscure path from a narrow set of addresses.
Then close the doors that turned the earlier victims into compromised web servers. Patch Roundcube, WordPress core and PrestaShop to current versions rather than to the version that was current when you launched. Rotate every credential attached to the account, including control panel, FTP, database and any API keys stored in configuration files, and treat any secret that ever touched a public repository as burned. The same server security hardening steps that stop opportunistic scanning also remove the easiest paths into compromised web servers.
Detail from the original research is worth reading directly if you administer public facing PHP applications, and The Hacker News writeup covers the full exploitation chain including the Windows side.
What Your Host Should Be Doing About It
Server level defense against compromised web servers is not something a site owner can install as a plugin. Account isolation stops one hijacked site on a shared machine from reaching its neighbors, which matters enormously when compromised web servers are being harvested at scale. Modern PHP versions with current security patches close whole families of exploitation paths. Outbound connection controls, mod_security rules and automatic malware scanning at the server layer catch the kind of shells that turn hosting accounts into compromised web servers, shells that a site owner would never notice. At MonsterMegs those protections run by default across our LiteSpeed powered web hosting plans, because the alternative is asking every customer to become a security analyst.
Ask your current provider three direct questions: how are accounts isolated from each other, what happens when malware is detected in an account, and how quickly do server side packages get patched after a CVE lands. Vague answers are an answer.
The Takeaway
Three things are worth carrying out of this story. Attackers have shifted from renting infrastructure to harvesting compromised web servers, which makes ordinary business websites strategically useful rather than merely opportunistic targets. The entry points remain mundane, with a year old unpatched CVE and purchased credentials doing the work that a zero day gets credit for. And the 88 percent figure on those leaked AWS keys shows that unrotated secrets stay dangerous for years, not weeks.
If you are not confident your current setup would catch a quiet PHP web shell, moving to a platform with account isolation and server level malware scanning built in is a reasonable next step, and our managed WordPress hosting handles the patching and monitoring side for you.
