A coordinated cyberattack has reportedly compromised 25 enterprise firewall systems across the United States, Japan, Taiwan and South Korea, with attackers gaining administrator-level access to affected servers. The campaign targeted internet-facing firewall management appliances and raised concerns about the security of internal corporate networks and government-affiliated infrastructure.
According to an investigation detailed in a report published on October 30, 2026, the attackers combined two PHP-related vulnerabilities with a Linux kernel security flaw to gain control of vulnerable systems. Among the affected infrastructure were three sensitive systems operating within an environment associated with an organisation affiliated with the US government.
Investigators found evidence that the attackers attempted to move beyond the initially compromised firewall systems and access internal network resources, including user information, group records and administrative configurations stored in Active Directory.
Attackers Used a Custom Exploit Chain
Forensic investigators examining files recovered on October 25 reportedly identified customised exploitation tools, reconnaissance records and nearly 40 scripts associated with activities following the initial compromise.
The campaign involved two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, alongside a Linux kernel privilege-escalation vulnerability tracked as CVE-2026-46300 and referred to as Fragnesia in the supplied report.
Rather than relying entirely on publicly available exploit frameworks, the attackers reportedly developed a customised approach targeting the Appweb Management Server used by the affected firewall platform.
The investigation indicates that the initial compromise provided limited system access, which was subsequently escalated to root-level privileges through the Linux kernel vulnerability. Attackers then reportedly installed webshells to maintain remote access to compromised systems.
The platform developer was informed about the vulnerabilities. However, the vendor's identity and affected firmware versions were not disclosed in the report to reduce the risk of further exploitation.
Reconnaissance Identified Thousands of Exposed Firewalls
The attackers reportedly used the FOFA internet asset-search platform to identify exposed enterprise firewall management interfaces.
The initial reconnaissance identified approximately 19,000 internet-accessible systems worldwide. Investigators said the attackers narrowed this list to around 5,000 devices with identifiable version information before selecting approximately 240 potential targets based on geographic and firmware characteristics.
During the primary operation, 24 firewall appliances were reportedly compromised. Root-level webshells were established on 22 devices where investigators did not identify further lateral movement.
The attackers appeared to place particular attention on infrastructure connected to a US government-affiliated organisation.
According to the investigation, files obtained from an initially compromised gateway exposed information about internal network architecture and additional servers. After that gateway unexpectedly crashed, the attackers reportedly shifted their attention to another firewall belonging to the same organisation on October 24.
They established a persistent connection to the companion device and subsequently used the access to reach an internal management system. This reportedly brought the total number of compromised systems to 25.
Active Directory and Digital Identity Systems Targeted
The investigation also identified attempts to access internal identity and directory services after the attackers gained visibility into the network.
Researchers reportedly found evidence that the attackers obtained an LDAP service account password and examined user groups within the organisation's central Active Directory environment.
Other suspected activities included password-spraying attempts, the creation of unauthorised administrative accounts and efforts to obtain SAML certificate-signing keys.
These activities raised concerns about the possibility of broader identity-system compromise. However, investigators have not confirmed whether the attackers successfully obtained control over the organisation's entire domain or secured all the credentials they were targeting.
The distinction is important because compromising a firewall does not automatically mean that every internal account or system has been taken over. The extent of access must be established through forensic examination.
AI Development Tools Found on Compromised Systems
Investigators also reportedly recovered references to Claude Code and automated scanning utilities associated with DeepSeek and Kimi environments on some compromised hosts.
The presence of these tools has attracted attention because of growing concerns about the use of artificial intelligence in cyber operations.
Researchers also identified Chinese-language prompts and timestamps corresponding to the UTC+8 time zone. These indicators may provide clues about the campaign's possible regional connections, but they do not establish the attackers' identity or nationality.
The investigation has not produced verifiable evidence attributing the operation to a specific hacking group. Nor has it confirmed that artificial intelligence was used to generate the exploits automatically.
Security Experts Urge Wider Forensic Checks
The incident highlights the risks associated with internet-facing security appliances that may themselves become entry points into protected networks.
Security specialists have advised organisations to do more than install software updates. Although applying vendor patches is essential to address the reported vulnerabilities, administrators should also examine systems for signs of unauthorised access that may remain after the initial security weakness has been fixed.
Recommended defensive priorities include reviewing privileged accounts, checking for unauthorised administrative activity, examining suspicious remote connections and conducting forensic assessments of affected network infrastructure.
Organisations should also review access to directory services and identity-management systems to determine whether credentials or sensitive configuration information may have been exposed.
The reported campaign demonstrates why regular security assessments, infrastructure monitoring and financial investigation and forensic support can be relevant when organisations need to examine suspicious activity, preserve records and understand potential business exposure.
The full extent of the reported breach remains under investigation. Until the affected vendor, firmware versions and final attribution are publicly established, organisations should treat the reported indicators cautiously and rely on verified security advisories for remediation decisions.