Executive Summary
In October 2026, threat actors began active exploitation of CVE-2026-42589, a critical remote code execution vulnerability (CVSS 9.8) in Gotenberg, an open-source PDF conversion API. The attack involves injecting ExifTool arguments via unsanitized metadata keys to execute arbitrary Perl code. While multiple clusters of activity have been identified—including commodity cryptomining using XMRig and scanning campaigns—one specific sophisticated cluster utilized a custom Go-based reverse shell named `cache_base` supported by dynamic DNS infrastructure and GitHub mirrors.
Technical analysis of the `cache_base` toolkit reveals a multi-platform arsenal developed over seven months, featuring variants for Linux, Windows, and ARM architectures. The associated infrastructure shows links to historical APT29 reporting, though direct attribution for this specific campaign remains unconfirmed. The toolkit includes Windows privilege escalation tools like JuicyPotatoNG and RegPwn, as well as WordPress and Joomla backdoors, indicating a focus on long-term access and lateral movement.
This activity is significant due to the high volume of Docker pulls for Gotenberg (97M+) and its widespread use in corporate document management. Organizations running unpatched Gotenberg instances (versions prior to 8.31.0) are at immediate risk of compromise by a variety of actors ranging from opportunistic miners to advanced persistent threats.