Backdooring Your Backdoors - Another $20 Domain, More Governments

watchTowr Labs went shopping for expired domains again, this time for the callback domains hardcoded into web shells such as r57shell and c99shell that attackers leave on servers they compromise. After registering more than 40 of them at about $20 each, they logged over 4,000 unique, live backdoors phoning home, including government systems in Bangladesh, China and Nigeria and universities in Thailand, China and South Korea. Several shells turn out to be backdoored themselves, leaking their location or even their login password to whoever holds the author’s domain. The Register quotes CEO Benjamin Harris calling it “mass-hacking-on-autopilot”, and the Shadowserver Foundation agreed to take over and sinkhole the domains. It is the same trick as watchTowr’s .MOBI research from September 2024, where the expired legacy WHOIS domain dotmobiregistry.net was still queried by more than 135,000 unique systems. Apparently attackers are no better at renewing domains than registries are.