Server

A Server Breach Went Undetected for 85 Days — Here's the Full Forensic Breakdown

By 野生码农AI实战 · Aug 16, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

The attack chain demonstrates that modern web hijacking bypasses file-level scans by abusing legitimate server software features like nginx's sub_filter. A compromised local machine is often the weakest link, turning a strong server password into a liability if stored in a browser.

Summary

A routine page check revealed a search-engine hijack that only triggered for mobile visitors from Baidu. The malicious code wasn't in the website files but injected into 16 nginx configuration files via the sub_filter directive, making file scans useless. Log analysis uncovered a backdoor account named 'linuxsafe' with UID 0 that had been dormant since May 22, alongside multiple root logins from foreign IPs.

The likely breach vector was a stolen root password from the developer's local Windows machine, not a brute-force attack. The investigation also exposed a wide-open MySQL root account accessible from any IP. The response involved evidence preservation, backdoor removal, credential rotation, and deploying fail2ban.

The attacker's four-tier infrastructure was fully mapped, from C2 servers in Hong Kong to disposable VPS jump boxes in Malaysia. Two Baidu Analytics IDs were extracted as asset fingerprints to correlate other victim sites. Five abuse reports were filed with registrars and hosting providers to dismantle the operation's infrastructure.

Takeaways

— Malicious code was hidden in nginx sub_filter directives across 16 PHP config files, not in the website's source files.

— A UID 0 backdoor account named 'linuxsafe' existed for 85 days before the hijack was noticed.

— The hijack script only activated for mobile users arriving from Chinese search engines and triggered once per device.

— Attackers used two IPs from the same Hong Kong /24 subnet for both the initial breach and C2 control.

— Two Baidu Analytics IDs were recovered from the malware chain, serving as unique gang fingerprints.

— Five abuse reports were sent to registrars NameSilo, NameCheap, and GoDaddy, plus two hosting providers.

— An open MySQL root account on port 3306 with a weak password was a secondary, long-standing exposure.

— fail2ban blocked three brute-force IPs within minutes of being deployed post-cleanup.

Conclusions

File integrity monitoring is insufficient when attackers abuse server software features like nginx sub_filter, which modify responses in transit without touching source files.

The ctime (change time) discrepancy was the forensic smoking gun; attackers can fake modification timestamps but not metadata change times on Linux.

Storing server credentials in a browser effectively downgrades a strong password's security to that of the local workstation, making infostealer malware the real threat vector.

The attacker's use of same-/24 IP space for both intrusion and C2 indicates operational sloppiness that enabled attribution.

Baidu Analytics IDs embedded in malware are durable, cross-campaign asset fingerprints that can link seemingly unrelated attacks to one group.

Concepts & terms

UID 0 backdoor

On Linux, the root user has UID 0. Creating another account with UID 0 grants it identical root privileges while appearing under a benign name, making it a stealthy persistence mechanism.

nginx sub_filter

A legitimate nginx module that substitutes one string for another in HTTP responses before they reach the client. Attackers used it to inject malicious scripts into every served page without modifying source files.

ctime vs mtime

In Linux file metadata, mtime is the last modification time (easily faked with tools like touch), while ctime is the last inode change time (updated by the kernel on permission or ownership changes and cannot be backdated).

Infostealer trojan

Malware designed to extract saved credentials, session tokens, SSH keys, and clipboard contents from a compromised machine, often targeting browser password stores.

fail2ban

An intrusion prevention tool that monitors log files for repeated authentication failures and dynamically blocks the offending IP addresses via firewall rules.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗