Adding IOCs from our investigation — 4 compromised cPanel servers
We had 4 cPanel servers hit in this campaign. Sharing our forensic findings to complement what's already in this thread.
Malware delivery host
87.121.84.78 — Served nuclear.x86 ELF binary. Confirmed part of the CVE-2026-41940 exploit campaign.
C2 / Persistence
165.154.199.52 — C2 server (resolved to 0xa59ac734). Dropper source + daily callback via installed backdoor at /etc/cron.daily/cpanel_sync. If you were compromised, check for this cron entry immediately — password reset alone is not sufficient.
Session injection / WHM root access
68.233.238.100 — Already listed above by @Vory We can confirm: used for unauthenticated session injection leading to direct WHM root access. Aligns with the API token persistence vector mentioned by @cPFence .
SorryLock ransomware delivery
68.183.190.253 — Delivered the SorryLock payload disguised as fav.ico. This is likely the vector @adamx12 experienced with .sorry extensions. The file masquerades as a favicon to bypass naive file-type checks.
Summary of persistence mechanisms we found:
Rogue WHM API tokens (as noted above)
/etc/cron.daily/cpanel_sync backdoor calling back to 165.154.199.52
Ransomware payload dropped as fav.ico before execution
Recommend checking all three on any server that was exposed, even if you think it was caught early.
