{
  "Event": {
    "uuid": "9cf6de91-da84-5074-bfca-e1f3961ed07c",
    "info": "CVE-2026-41940 cPanel Harvester Toolkit (216.126.227.49)",
    "date": "2026-05-17",
    "threat_level_id": 1,
    "analysis": 2,
    "timestamp": 1791727784,
    "publish_timestamp": 1791727784,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"Exploitation\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Cred Theft\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Phishing\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Open Dir\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:actor=\"UTA-2026-011\"",
        "colour": "#e879f9"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Portal Capture - T1056.003\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH Authorized Keys - T1098.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Device Registration - T1098.005\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Spraying - T1110.003\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Credential Access - T1212\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Execution Guardrails - T1480\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Generation Algorithms - T1568.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Server - T1583.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Malvertising - T1583.008\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1587.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploits - T1588.005\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Scanning IP Blocks - T1595.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Financial Theft - T1657\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "c383c4a8-5a91-5195-8cf9-5153bc96b94f",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791727784
      },
      {
        "uuid": "f6e6134a-5d03-5b5d-82dd-b39b7104f933",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-iocs.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791727784
      },
      {
        "uuid": "545e0422-8e91-5184-8ae7-73457336e4e6",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1791727784
      },
      {
        "uuid": "521efe96-b4a6-57ae-9a21-26edcda9c1c0",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1791727784
      },
      {
        "uuid": "b70322fd-37e0-54e7-a2b2-9054b583b81c",
        "type": "vulnerability",
        "category": "External analysis",
        "value": "CVE-2017-0199",
        "to_ids": false,
        "comment": "Named in the report",
        "timestamp": 1791727784
      },
      {
        "uuid": "eece9462-a558-5afe-af2f-1c39b5ed3899",
        "type": "vulnerability",
        "category": "External analysis",
        "value": "CVE-2026-41940",
        "to_ids": false,
        "comment": "Named in the report",
        "timestamp": 1791727784
      },
      {
        "uuid": "baa6b876-63a1-5a57-a3d8-6bef08db6c9d",
        "type": "domain",
        "category": "Network activity",
        "value": "adorarama.com",
        "to_ids": true,
        "comment": "domain: adorarama.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "f3490632-e1b1-501a-b766-bd86b8d8b869",
        "type": "domain",
        "category": "Network activity",
        "value": "checkwithsec.online",
        "to_ids": true,
        "comment": "domain: checkwithsec.online. Security-service spoof (locks to eps-soltec via NameCheap org) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "89a77a05-0dde-5fcf-a8f4-c6aee38ea661",
        "type": "domain",
        "category": "Network activity",
        "value": "coinbase-co.cc",
        "to_ids": true,
        "comment": "domain: coinbase-co.cc. Coinbase spoof (15/92 VT malicious) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "b6b9a195-40e9-561b-8abb-7cc53939c396",
        "type": "domain",
        "category": "Network activity",
        "value": "eps-soltec.cloud",
        "to_ids": true,
        "comment": "domain: eps-soltec.cloud. Office 365 phishing (officebyt.e56sutx.eps-soltec.cloud) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "493a7d1f-b24f-5527-bcf7-b92ab3408917",
        "type": "domain",
        "category": "Network activity",
        "value": "gocomper.com",
        "to_ids": true,
        "comment": "domain: gocomper.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "9d5850a6-85da-5b88-af7d-7fb6ab3240be",
        "type": "domain",
        "category": "Network activity",
        "value": "groundsstudio.com",
        "to_ids": true,
        "comment": "domain: groundsstudio.com. Operator wildcard-DNS abuse (kjeywrgo.groundsstudio.com, _dmarc.qavfcyopzp.groundsstudio.com) [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "bd033782-e338-5302-b373-1eada0185b81",
        "type": "domain",
        "category": "Network activity",
        "value": "kucoinsgem.xyz",
        "to_ids": true,
        "comment": "domain: kucoinsgem.xyz. KuCoin spoof (operator brand-spoof in TDS chain) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "0fadcc89-4a72-5487-bd05-87bc62ed3ba2",
        "type": "domain",
        "category": "Network activity",
        "value": "kwpbby.in",
        "to_ids": true,
        "comment": "domain: kwpbby.in. Disposable .in TLD; Pornography/Scam categorization [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "52c4b679-1855-5d20-9dc1-2ebd49510b56",
        "type": "domain",
        "category": "Network activity",
        "value": "ltamaeropromoweb-ecuador-travel.shop",
        "to_ids": true,
        "comment": "domain: ltamaeropromoweb-ecuador-travel.shop. Ecuador-travel-themed scam (LATAM Airlines spoof) on operator IP 216.126.227.148 [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "ba9d4f76-6c1a-51b5-a1eb-127a22d9c95a",
        "type": "domain",
        "category": "Network activity",
        "value": "mail.hcjs2.jlengineering.se",
        "to_ids": true,
        "comment": "domain: mail.hcjs2.jlengineering.se. Do NOT blocklist apex jlengineering.se - it is a multi-tenant donor domain [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "9176a581-ee2d-5303-84a7-14c8769aab65",
        "type": "domain",
        "category": "Network activity",
        "value": "mailmanagement.cfd",
        "to_ids": true,
        "comment": "domain: mailmanagement.cfd. Email-management phishing (10/92 VT malicious) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "c9808f44-9670-54a8-8078-890c90aab54e",
        "type": "domain",
        "category": "Network activity",
        "value": "mmnsdvrt8.eps-soltec.cloud",
        "to_ids": true,
        "comment": "domain: mmnsdvrt8.eps-soltec.cloud. Operator kit-generated random subdomain (hosted on 144.172.116.74) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "7ab8c0ff-c510-5e88-810a-4a2bac140500",
        "type": "domain",
        "category": "Network activity",
        "value": "mrrbno.shop",
        "to_ids": true,
        "comment": "domain: mrrbno.shop. Current cert subject on operator IP 144.172.116.74 [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "578c3672-20ac-50d8-9b51-eae6ff37f9a7",
        "type": "domain",
        "category": "Network activity",
        "value": "mx.plingest.com",
        "to_ids": true,
        "comment": "domain: mx.plingest.com. Operator MX hostname - shared across supportsite.info, adorarama.com, gocomper.com [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "02697f68-1920-50f8-b4ea-a5d69114ee25",
        "type": "domain",
        "category": "Network activity",
        "value": "officebyt.e56sutx.eps-soltec.cloud",
        "to_ids": true,
        "comment": "domain: officebyt.e56sutx.eps-soltec.cloud. Operator Office 365 phishing subdomain [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "9e4c1fd8-f003-56f1-8e86-abe2bc1a1178",
        "type": "domain",
        "category": "Network activity",
        "value": "pernex.online",
        "to_ids": true,
        "comment": "domain: pernex.online. Current operator ops domain - cert subject on 216.126.227.49 [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "0134d5cb-13df-5c77-b100-8a5fc1368e49",
        "type": "domain",
        "category": "Network activity",
        "value": "plingest.com",
        "to_ids": true,
        "comment": "domain: plingest.com. Operator MX backend host (mx.plingest.com) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "3d653486-73e6-5f57-8f2e-5121fd69a389",
        "type": "domain",
        "category": "Network activity",
        "value": "promo-de-natal-livelo.com",
        "to_ids": true,
        "comment": "domain: promo-de-natal-livelo.com. Brazilian Livelo rewards spoof; resolves to operator MX backend [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "27cd1230-a12d-54ab-a261-02b0c6699292",
        "type": "domain",
        "category": "Network activity",
        "value": "quick-barber.com",
        "to_ids": true,
        "comment": "domain: quick-barber.com. Brand-new local-business spoof (registered 2026-05-02) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "df82a5e3-116e-5899-849d-6d782fda103f",
        "type": "domain",
        "category": "Network activity",
        "value": "receita-federal.com",
        "to_ids": true,
        "comment": "domain: receita-federal.com. Brazilian Federal Revenue spoof [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "f7d278da-35b0-5305-85ed-93e754007f70",
        "type": "domain",
        "category": "Network activity",
        "value": "runwaylander.com",
        "to_ids": true,
        "comment": "domain: runwaylander.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "b595ac13-d37c-58f8-912b-e1b43485d000",
        "type": "domain",
        "category": "Network activity",
        "value": "runwaylanderhome.com",
        "to_ids": true,
        "comment": "domain: runwaylanderhome.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "243e89ad-f0ec-5cdc-8217-3171c5b7e358",
        "type": "domain",
        "category": "Network activity",
        "value": "runwaylanderlights.com",
        "to_ids": true,
        "comment": "domain: runwaylanderlights.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "2105bd19-60bf-5930-80aa-66425c3634e5",
        "type": "domain",
        "category": "Network activity",
        "value": "runwaylanderplace.com",
        "to_ids": true,
        "comment": "domain: runwaylanderplace.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "d1b5066e-4559-5b99-8e3b-2c3598bad614",
        "type": "domain",
        "category": "Network activity",
        "value": "runwaylanderspot.com",
        "to_ids": true,
        "comment": "domain: runwaylanderspot.com. TDS landing parent (98 historical subdomains including ~30 operator kit-pattern UUID-format) on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "28260d56-9a8a-53d3-b256-9177460a4fc0",
        "type": "domain",
        "category": "Network activity",
        "value": "runwaylanderstreet.com",
        "to_ids": true,
        "comment": "domain: runwaylanderstreet.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "0784784d-c6d5-5400-b867-6a4d132a1185",
        "type": "domain",
        "category": "Network activity",
        "value": "runwayparking.com",
        "to_ids": true,
        "comment": "domain: runwayparking.com. TDS landing parent on Parklogic [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "51726d81-30f3-5b9b-9d6d-f87a486bedbd",
        "type": "domain",
        "category": "Network activity",
        "value": "supportsite.info",
        "to_ids": true,
        "comment": "domain: supportsite.info. Tech-support scam + Amazon spoof + M365 (12/92 VT malicious) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "2bc9ed89-349a-5289-bbd8-b5cde18c45fd",
        "type": "domain",
        "category": "Network activity",
        "value": "tesaco.sbs",
        "to_ids": true,
        "comment": "domain: tesaco.sbs. Staged for next campaign (parked on 127.0.0.1) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "38c43fdf-02e8-5354-aa7b-7cefde8bb274",
        "type": "domain",
        "category": "Network activity",
        "value": "yahoohelp.com",
        "to_ids": true,
        "comment": "domain: yahoohelp.com. Yahoo support spoof (HIGH-MONETIZED, ownership ambiguous - full operator infra pattern but Rebel org-hash differs) [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "f5f8494e-1c76-5301-9b7e-383714e50d54",
        "type": "url",
        "category": "Network activity",
        "value": "http://216.126.224.181/22/evc/goodpeopleswellmeans.hta",
        "to_ids": true,
        "comment": "url: http://216.126.224.181/22/evc/goodpeopleswellmeans.hta. HTA dropper on Gen-1 box [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "ffe27022-f974-5409-9db4-43708e7d6e51",
        "type": "url",
        "category": "Network activity",
        "value": "http://216.126.224.181/23/goodpersonforbetterthings.hta",
        "to_ids": true,
        "comment": "url: http://216.126.224.181/23/goodpersonforbetterthings.hta. HTA dropper on Gen-1 box [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "ce302e3a-601a-54a3-9e6c-035ec06f6772",
        "type": "url",
        "category": "Network activity",
        "value": "http://216.126.224.181/wem/img_191738.png",
        "to_ids": true,
        "comment": "url: http://216.126.224.181/wem/img_191738.png. Phishing asset / tracking pixel on Gen-1 box [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "c1c5c95f-42a4-56ac-9040-018a57b0d8e8",
        "type": "url",
        "category": "Network activity",
        "value": "https://216.126.224.181/24/mkaingbestchoiceforme.hta",
        "to_ids": true,
        "comment": "url: https://216.126.224.181/24/mkaingbestchoiceforme.hta. HTA dropper on Gen-1 box [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "0fbecbd5-8c30-5a68-896d-4ac047d2966c",
        "type": "url",
        "category": "Network activity",
        "value": "https://mgcountyks.invoicerequests.net/",
        "to_ids": true,
        "comment": "url: https://mgcountyks.invoicerequests.net/. Operator-attribution via IP co-tenancy at 45.61.128.128 only [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "c7663c10-dcac-5cbb-8d89-1e95d8dbbbe0",
        "type": "url",
        "category": "Network activity",
        "value": "https://officebyt.e56sutx.eps-soltec.cloud/f/d6aba322369c",
        "to_ids": true,
        "comment": "url: https://officebyt.e56sutx.eps-soltec.cloud/f/d6aba322369c. Office 365 phishing payload-fetch URL (/f/<12-hex> kit pattern) [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "9e8e92c4-4522-526b-a0f9-570d16d39977",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "144.172.103.253",
        "to_ids": true,
        "comment": "ipv4: 144.172.103.253. Current operator Office 365 phishing host [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "e89eb246-611e-5135-9778-047da5053674",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "144.172.105.176",
        "to_ids": true,
        "comment": "ipv4: 144.172.105.176. Prior operator host (Gen-1) [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "f506a992-614b-583c-bad9-10d3f48e4c5c",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "144.172.116.74",
        "to_ids": true,
        "comment": "ipv4: 144.172.116.74. Operator IP - hosts mmnsdvrt8.eps-soltec.cloud + mrrbno.shop [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "924dff78-5411-518d-ac62-58c9cc13d462",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "144.172.122.226",
        "to_ids": true,
        "comment": "ipv4: 144.172.122.226. Earliest mailmanagement.cfd host [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "2691f6f6-5ec9-5b39-8365-bdf4ebd07b73",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "144.172.97.151",
        "to_ids": true,
        "comment": "ipv4: 144.172.97.151. Prior operator host (supportsite.info Sep 2025 + current mailmanagement.cfd) [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "aaed6428-3bdc-5193-a420-c9f194a763c3",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "172.234.24.120",
        "to_ids": true,
        "comment": "ipv4: 172.234.24.120. Parklogic shared TDS landing infrastructure family member | HIGH - shared Parklogic infrastructure [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "ee108c18-4740-56f9-94fc-a36f702eb094",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "216.126.224.181",
        "to_ids": true,
        "comment": "ipv4: 216.126.224.181. April 2026 commodity-malware activity (Urcbadur/Alien/ADKP via CVE-2017-0199) on this IP is LOW-MODERATE operator-attributable; likely different tenant [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "83b90dc9-a3c4-5984-82b5-b5f5453c55da",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "216.126.227.148",
        "to_ids": true,
        "comment": "ipv4: 216.126.227.148. Operator IP - hosts www.supportsite.info + ltamaeropromoweb-ecuador-travel.shop [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "068f7530-3241-5aa8-b5b9-392fb52c7076",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "216.126.227.49",
        "to_ids": true,
        "comment": "ipv4: 216.126.227.49. Active C2; also TCP/22 SSH open [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "dc47e548-dfbe-59ce-90b0-44fe4700ec45",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "38.143.66.193",
        "to_ids": true,
        "comment": "ipv4: 38.143.66.193. Treat any inbound email originating from this MX as high-risk [confidence 80/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "39271e60-6676-5aa4-9e83-8da4501da4e0",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "45.61.128.128",
        "to_ids": true,
        "comment": "ipv4: 45.61.128.128. Early operator IP (supportsite.info Feb-May 2025); medical/government BEC subdomains under *.invoicerequests.net may be different tenant [confidence 60/100]",
        "timestamp": 1791727784
      },
      {
        "uuid": "67cc0136-1fc4-5027-b81c-a14c6ef77694",
        "type": "snort",
        "category": "Network activity",
        "value": "alert http any any -> any any (msg:\"THL DETECT CVE-2026-41940 Candidate cPanel WHM Control Char After Base64 in Authorization Basic\"; flow:established,to_server; content:\"Authorization|3a|\"; nocase; http_header; pcre:\"/Authorization:\\s*Basic\\s+[A-Za-z0-9+\\/=]+(?:\\x00|%00|%0[aAdD])/Hi\"; reference:cve,2026-41940; reference:url,the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/; reference:url,the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/; classtype:web-application-attack; sid:9100101; rev:5; metadata:author The_Hunters_Ledger, date 2026-05-17;)",
        "to_ids": true,
        "comment": "Null Byte or Encoded CR/LF After the Base64 Run in an Authorization Basic Header (CVE-2026-41940 Candidate) | TIER: Detection | robustness 3 | confidence MODERATE | ATT&CK T1212, T1190 | rule hash 096a6737 | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "eb859da6-0f7b-513c-b3aa-8e25d2c1da64",
        "type": "snort",
        "category": "Network activity",
        "value": "alert http any any -> any any (msg:\"THL HUNT CVE-2026-41940 Operator Flask C2 Dashboard - Werkzeug/3.1.8 Banner with /login-2fa Redirect\"; flow:established,to_client; http.server; content:\"Werkzeug/3.1.8 Python/3.13.12\"; endswith; nocase; http.header; content:\"Location|3a 20|/login-2fa\"; nocase; reference:url,the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/; reference:url,the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/; classtype:trojan-activity; sid:9100102; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-17;)",
        "to_ids": false,
        "comment": "Operator Flask C2 Dashboard Banner Hunt: Werkzeug/3.1.8 + /login-2fa | TIER: Hunting | robustness 2 | confidence HIGH for the banner match today; durability is limited (see Rationale) | ATT&CK T1071.001 | rule hash 3f4a99ed | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "922976db-4597-5839-98d3-cac470c1d5a0",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: CVE-2026-41940 Expired Session Marker in Query String\nid: a4c8e17b-3f92-4d6e-b08a-5c2d9e4f1a73\nstatus: experimental\ndescription: >-\n  Detects the string 'expired=1' in a request URI query string (the rule has no cPanel or WHM host\n  test). The same token is the CVE-2026-41940 PoC-exact value that the public PoC documentation\n  places in the Authorization: Basic header credential portion to trigger the CRLF auth bypass.\n  Raw Authorization header content is not a standard webserver logsource field and the rule tests\n  only cs-uri-query; no logging profile that carries the marker from the header into the query\n  string was observed, so whether this rule sees CVE-2026-41940 exploitation at all is NOT CHECKED.\n  'expired=1' is also a generic session-timeout query parameter used by unrelated web\n  applications, so treat matches as a triage lead rather than a confirmed hit.\nreferences:\n    - https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940\nauthor: The Hunters Ledger\ndate: 2026-05-17\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - attack.credential-access\n    - attack.t1212\n    - detection.emerging-threats\nlogsource:\n    category: webserver\ndetection:\n    selection_expired_token:\n        cs-uri-query|contains: 'expired=1'\n    condition: selection_expired_token\nfalsepositives:\n    - Unrelated web applications using 'expired=1' as a generic session-timeout query parameter\n    - Authorized security scanning tools probing cPanel installations\nlevel: medium",
        "to_ids": false,
        "comment": "CVE-2026-41940 Expired Session Marker in Query String | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1190, T1212 | rule hash e68ca312 | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "1c5dbebf-0f07-5cef-b074-310e37b4f0d5",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: CVE-2026-41940 cPanel WHM Proxy-Subdomain Admin Path Request\nid: 7f3a2c91-e8d4-4b5a-9c1f-3e6d7a2b0f84\nstatus: experimental\ndescription: >-\n  Detects reconnaissance or exploitation attempts against the CVE-2026-41940 proxy-subdomain\n  admin paths, a CVSS 9.8 pre-authentication CRLF injection vulnerability in cPanel and WHM\n  (disclosed 2026-04-28). The operator toolkit file pipeline-41940.sh at 216.126.227.49\n  directly encodes this CVE. Raw Authorization header content, where the actual null-byte or\n  CRLF injection occurs, is not exposed as a standard webserver logsource field, so this rule\n  anchors on the fixed cPanel/WHM proxy-subdomain path markers the exploit chain targets\n  instead — it flags any request to these paths for analyst triage, not a confirmed injection.\nreferences:\n    - https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940\nauthor: The Hunters Ledger\ndate: 2026-05-17\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - attack.credential-access\n    - attack.t1212\n    - detection.emerging-threats\nlogsource:\n    category: webserver\ndetection:\n    selection_auth_null:\n        cs-uri-stem|contains:\n            - '/___proxy_subdomain_whm'\n            - '/___proxy_subdomain_cpanel'\n    condition: selection_auth_null\nfalsepositives:\n    - >-\n      Legitimate administrator or monitoring traffic to the WHM/cPanel proxy-subdomain\n      admin interface on hosts where the feature is enabled and internet-reachable\n    - Authorized security assessment tools (Burp Suite, Nuclei, Metasploit) running assessments against cPanel infrastructure\n    - Security researchers probing CVE-2026-41940 in controlled environments\nlevel: medium",
        "to_ids": false,
        "comment": "CVE-2026-41940 cPanel WHM Proxy-Subdomain Admin Path Request | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1190, T1212 | rule hash f56bdfe8 | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "dad89218-8f76-58dd-9f67-a2967fd6611e",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: CVE-2026-41940 cPanel WHM Proxy-Subdomain Admin Path Request With HTTP 200 Response\nid: 2e8b5d9f-71a3-4c8e-a25b-6f0d3c7e9b12\nstatus: experimental\ndescription: >-\n  Detects HTTP 200 responses to the CVE-2026-41940 proxy-subdomain admin path markers, used\n  as a coarse proxy for the server-side confirmation string 'msg_code:[expired_session]' that\n  cPanel/WHM returns in the response body after a successful CRLF auth bypass. Standard\n  webserver logsource fields do not expose raw response-body content, so the exact\n  confirmation string cannot be matched here — deploy a response-body string match at the\n  application or WAF layer for high-confidence exploitation confirmation, and use this rule\n  only to narrow the candidate set for that manual or WAF-layer review.\nreferences:\n    - https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940\nauthor: The Hunters Ledger\ndate: 2026-05-17\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - attack.credential-access\n    - attack.t1212\n    - detection.emerging-threats\nlogsource:\n    category: webserver\ndetection:\n    selection_auth_bypass_path:\n        cs-uri-stem|contains:\n            - '/___proxy_subdomain_whm'\n            - '/___proxy_subdomain_cpanel'\n    selection_success_status:\n        sc-status: 200\n    condition: selection_auth_bypass_path and selection_success_status\nfalsepositives:\n    - >-\n      Any successful request to the proxy-subdomain path markers — this rule cannot isolate\n      the response-body confirmation string without response-body visibility; treat matches\n      as candidates for manual or WAF-layer confirmation, not standalone high-confidence alerts\nlevel: low",
        "to_ids": false,
        "comment": "CVE-2026-41940 cPanel WHM Proxy-Subdomain Admin Path Request With HTTP 200 Response | TIER: Hunting | robustness 2 | confidence LOW | ATT&CK T1190, T1212 | rule hash 4e7ab5a5 | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "a67e9974-6a33-5617-9b50-6e0ee0914f8c",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Operator Flask C2 Dashboard Request URI Containing /login-2fa\nid: 5c7d1e4a-9b83-4f2c-8e67-1a3f5c8d2b90\nstatus: experimental\ndescription: >-\n  Detects requests whose URI contains the text /login-2fa (a substring test, not an exact path), the redirect target of the Flask C2 dashboard\n  operated by the CVE-2026-41940 cPanel harvester cluster (216.126.227.49). The server\n  presents HTTP Server: Werkzeug/3.1.8 Python/3.13.12 with a 302 redirect to /login-2fa on\n  the initial unauthenticated request; the Werkzeug development server on an internet-facing\n  port combined with this custom path fingerprints the operator's deployment pattern.\n  Standard proxy logsource fields do not expose response headers (Server banner, Location\n  redirect target), so this rule matches the client-request path itself, without host\n  scoping — it is intended for peer-C2 discovery across a monitored proxy segment, not as a\n  host-specific alert; retain the Shodan/Censys Werkzeug-banner pivot as a complementary\n  out-of-band OSINT hunting technique.\nreferences:\n    - https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/\nauthor: The Hunters Ledger\ndate: 2026-05-17\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\n    - detection.emerging-threats\nlogsource:\n    category: proxy\ndetection:\n    selection_login2fa_path:\n        c-uri|contains: '/login-2fa'\n    condition: selection_login2fa_path\nfalsepositives:\n    - >-\n      Legitimate Flask developers running a login route named /login-2fa on a monitored\n      proxy segment (uncommon; verify destination host against confirmed operator infrastructure)\n    - Security researchers replicating the operator's C2 in a lab environment\nlevel: medium",
        "to_ids": false,
        "comment": "Operator Flask C2 Dashboard Request URI Containing /login-2fa | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1071.001 | rule hash 315ec70d | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "a7bf4e49-2839-54c7-9aec-71bedb23edd1",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Operator TDS Landing URL Pattern - Parklogic Source-Referer Shape with Campaign Hash\nid: 3d6c9a7e-2f41-4b8d-c53e-9a1b7f3e5d28\nstatus: experimental\ndescription: >-\n  Detects the URL pattern used by the CVE-2026-41940 cPanel harvester operator's Parklogic\n  TDS traffic distribution system. The observed shape is /?d=<source-domain>&a=2143526812&s=<64-hex>\n  where d= is the source/referrer domain, a= is the operator's Parklogic affiliate account\n  ID (constant: 2143526812), and s= is a per-source-domain campaign hash (64 hex characters).\n  The rule tests only the a= and s= parameters, each as a whole parameter, in any order; d= and\n  the leading /? are not required.\n  This shape routes victims from compromised or spoof landing pages through to phishing\n  destinations. The account ID is the sole discriminator that ties this shape to this specific\n  operator rather than any other Parklogic customer; without it the /?d=&s=<64-hex> shape\n  alone is generic Parklogic platform traffic.\nreferences:\n    - https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/\nauthor: The Hunters Ledger\ndate: 2026-05-17\ntags:\n    - attack.resource-development\n    - attack.t1583.008\n    - detection.emerging-threats\nlogsource:\n    category: proxy\ndetection:\n    selection_account:\n        c-uri-query|re: '(.*[?\\&])?a=2143526812(\\&.*)?'\n    selection_s_param:\n        c-uri-query|re: '(.*[?\\&])?s=[a-f0-9]{64}(\\&.*)?'\n    condition: selection_account and selection_s_param\nfalsepositives:\n    - Other Parklogic customers using the same platform with different a= values (filtered by the a=2143526812 requirement)\n    - Security researchers reproducing the operator's TDS chain in testing environments\nlevel: medium",
        "to_ids": false,
        "comment": "Operator Parklogic TDS Landing URL Shape | TIER: Hunting | robustness 2 | confidence HIGH | ATT&CK T1583.008 | rule hash 772431b2 | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "007ce09e-7f07-5da0-953d-b281661b6ac2",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Post-CVE-2026-41940 Exploitation - File Event Under cPanel Users Directory From a Non-cPanel Process\nid: 1b7e3f8a-5c4d-4e9b-a17c-8f2b6e4d0c39\nstatus: experimental\ndescription: >-\n  Detects a file event (creation or modification) under /var/cpanel/users/ from a process whose\n  image path is not under /usr/local/cpanel/ or /usr/local/whm/, a lead for the documented\n  post-exploitation persistence and monetization tradecraft following a CVE-2026-41940 CRLF\n  auth bypass. The rule keeps no admin-session state and does not separate a new account file\n  from an edit to an existing one. The operator toolkit at 216.126.227.49 includes gen-cpanel-access.py (6070\n  bytes, hash unavailable) which is inferred — not directly observed — to generate cPanel\n  access artifacts post-compromise; treat matches as a triage lead requiring correlation with\n  reseller/customer signup records, not a standalone high-confidence indicator.\nreferences:\n    - https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940\nauthor: The Hunters Ledger\ndate: 2026-05-17\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - detection.emerging-threats\nlogsource:\n    category: file_event\n    product: linux\ndetection:\n    selection_cpanel_user_create:\n        TargetFilename|startswith: '/var/cpanel/users/'\n    filter_whm_admin:\n        # sourced: /usr/local/cpanel/ is cPanel's documented install root; the /usr/local/whm/ entry was inherited from the earlier draft and is NOT CHECKED against cPanel documentation\n        Image|startswith:\n            - '/usr/local/cpanel/'\n            - '/usr/local/whm/'\n    condition: selection_cpanel_user_create and not filter_whm_admin\nfalsepositives:\n    - >-\n      Legitimate new customer account creation by authorized resellers (correlate against\n      reseller activity logs and customer signup records)\n    - Automated cPanel processes creating internal system accounts\n    - Routine cPanel upgrades creating new system user files\nlevel: medium",
        "to_ids": false,
        "comment": "Post-Exploitation File Event Under /var/cpanel/users/ From a Process Outside cPanel's Own Directories | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1136.001 | rule hash c92180c4 | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7b962ac0-bb82-5430-845f-eedb75afaf28",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: SSH Authorized Keys File Written Under Root or Home Directories by a Process Outside the OpenSSH Tools\nid: 6a4f8e2b-1c95-4d7a-f38d-2e9b0c6a5f17\nstatus: experimental\ndescription: >-\n  Detects a file event for an SSH authorized_keys file under /root or a /home (or /home2 and\n  similar) user directory, written by a process that is not sshd or ssh-copy-id. Nothing in the\n  rule tests for a cPanel/WHM host or for CVE-2026-41940. Key planting is documented\n  post-exploitation persistence tradecraft after a CVE-2026-41940 CRLF auth bypass, but it is a\n  generic Linux persistence primitive inferred from standard post-WHM-root tradecraft, not\n  directly observed in the operator's recovered toolkit source, and it is most actionable when\n  correlated with a prior CVE-2026-41940 exploitation attempt in web access logs for the same\n  host.\nreferences:\n    - https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940\nauthor: The Hunters Ledger\ndate: 2026-05-17\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1098.004\n    - detection.emerging-threats\nlogsource:\n    category: file_event\n    product: linux\ndetection:\n    selection_ssh_keys:\n        TargetFilename|startswith:\n            - '/root/'\n            - '/home'\n        TargetFilename|endswith: '/.ssh/authorized_keys'\n        TargetFilename|re: '(/root|/home[0-9]*/[^/]+)/\\.ssh/authorized_keys'\n    filter_admin_tools:  # sourced: the OpenSSH server and ssh-copy-id are the standard writers of this file (platform defaults)\n        Image|contains:\n            - '/usr/sbin/sshd'\n            - '/usr/bin/ssh-copy-id'\n    condition: selection_ssh_keys and not filter_admin_tools\nfalsepositives:\n    - >-\n      Legitimate administrator key management via ssh-copy-id or direct authorized_keys\n      editing (use change-management correlation to exclude)\n    - Automated configuration management tools (Ansible, Puppet, Chef) managing SSH keys\n    - CI/CD pipeline deployment keys being rotated\nlevel: medium",
        "to_ids": false,
        "comment": "SSH Authorized Keys File Written Under Root or Home Directories by a Process Outside the OpenSSH Tools | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1098.004 | rule hash 077c126d | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "5b11fb86-7859-5c73-ba7a-55b63cb216a6",
        "type": "yara",
        "category": "Payload installation",
        "value": "/*\n   Yara Rule Set\n   Identifier: cPanel Harvester Toolkit — CVE-2026-41940 Operator Files\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule TOOLKIT_CpanelHarvester41940_KnownFiles {\n   meta:\n      description = \"Detects the operator-built cPanel/WHM credential-harvester toolkit (CVE-2026-41940 exploitation cluster, 216.126.227.49) via a required combination of two or more bespoke, operator-coined component filenames referenced in the toolkit's own orchestrator source or captured in directory-listing/log content. File-hash matching for the eight highest-value toolkit files is carried in the campaign IOC feed, not this rule\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/\"\n      date = \"2026-05-17\"\n      hash1 = \"4b054892b4a5d7811f57562552d1ea0e8ea5bfbf705ceb71e91126482b650a47\"\n      family = \"cPanel-Harvester-Toolkit-CVE-2026-41940\"\n      malware_type = \"Credential Harvester / Exploitation Toolkit\"\n      campaign = \"OpenDirectory-CVE-2026-41940-cPanel-Harvester-216.126.227.49\"\n      id = \"f0965e55-2c67-5830-bed9-0d228e6cff14\"\n   strings:\n      $fn_pipeline    = \"pipeline-41940\" ascii wide\n      $fn_live_dash   = \"live-dashboard-v10\" ascii wide\n      $fn_whm_hunter  = \"whm-hunter\" ascii wide\n      $fn_beast_dash  = \"beast-dashboard\" ascii wide\n      $fn_beast_page  = \"gen-beast-page\" ascii wide\n      $fn_megahunt    = \"megahunt-fast\" ascii wide\n      $fn_toolkit_dir = \"cpanel-toolkit-export\" ascii wide\n   condition:\n      filesize < 50KB and\n      2 of ($fn_pipeline, $fn_live_dash, $fn_whm_hunter, $fn_beast_dash,\n            $fn_beast_page, $fn_megahunt, $fn_toolkit_dir)\n}",
        "to_ids": true,
        "comment": "CVE-2026-41940 cPanel Harvester Toolkit: Bespoke Component Filenames | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1587.001, T1588.005 | rule hash e35970b4 | https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
        "timestamp": 1791727784,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}