Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
Summary: Unit 42 researchers documented a campaign it tracks as CL-CRI-0021, attributed to the actor behind the earlier Manic Menagerie operation, that targeted web hosting and IT providers in the United States and European Union from late 2020 to late 2022. The attackers exploited vulnerable web applications and IIS servers, deployed web shells including xn.aspx and ASPXSpy across hundreds of paths, added coin miners, and used tools such as RunasCs, PrintSpoofer, PCHunter, and a custom sh.exe to add users to the Administrators group and write web shells at scale.
Bottom line: The hijacked legitimate websites could have been turned into command and control servers at scale, affecting thousands of web pages and exposing their owners to legal and reputational damage, while the actor's repeated redeployment of blocked tools and use of custom and legitimate utilities kept the activity out of sight of commercial security products.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026