Executive Summary
Since late April 2026, a hacking group internally named Mr_Rot13 has been actively exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM. This vulnerability allows unauthenticated remote attackers to gain full administrator privileges on Linux servers. Monitoring shows the actor is using this access to target government and military institutions, primarily in Southeast Asia, resulting in significant data exfiltration.
Technically, the actor deploys a Go-based infector named 'Payload' which automates post-exploitation tasks including SSH key injection, credential theft via malicious JavaScript, and the deployment of a cross-platform remote-control tool called 'filemanager'. Infrastructure analysis reveals the group has been operational since at least 2020, demonstrating high levels of operational security and long-term persistence across multiple campaigns targeting WordPress and cPanel environments.
Due to the critical nature of the vulnerability (CVSS 9.8) and the actor's ability to maintain a low detection profile for years, organizations utilizing cPanel/WHM must immediately verify patch levels and hunt for unauthorized modifications to login templates and web server configurations.