Cybersecurity researchers have uncovered an active web traffic hijacking campaign abusing malicious NGINX configurations to silently reroute legitimate user traffic through attacker-controlled infrastructure.
🧪 What’s happening
Threat actors are injecting rogue proxy_pass directives into NGINX configs, enabling man-in-the-middle traffic interception without deploying traditional malware.
🔧 Attack tooling observed
The multi-stage toolkit includes:
- 🧩
zx.sh– orchestration & payload delivery - ⚙️
bt.sh– overwrites configs in Baota (BT) panels - 🗂️
4zdh.sh/zdh.sh– NGINX path enumeration & targeting - 📊
ok.sh– reporting on active hijack rules
🌍 Target profile
- Asian TLDs:
.in,.id,.bd,.th,.pe - Government & education domains:
.gov,.edu - Chinese hosting infrastructure & exposed management panels
🚨 Initial access & scale
Datadog links the activity with moderate confidence to exploitation of React2Shell (CVE-2025-55182, CVSS 10.0).
GreyNoise reports 1,000+ unique IPs involved, with dominant actors favoring interactive access over cryptomining.
⚠️ Why this matters
This campaign demonstrates how configuration-level compromise can enable stealthy traffic interception, credential harvesting, and downstream attacks — all without dropping binaries on disk.
What this means for enterprises
• Configuration integrity is now a critical security control – attackers are compromising web traffic by altering NGINX configs, bypassing traditional malware detection entirely.
• Management panels are high-risk entry points – exposed tools like Baota (BT) can provide direct paths to production traffic manipulation if not tightly restricted.
• Traffic hijacking enables silent compromise – credential theft, session hijacking, and data interception can occur without alerts or endpoint artifacts.
• Patch speed and access control matter – React2Shell exploitation shows how quickly critical flaws are weaponized once disclosed.
• Visibility must extend beyond endpoints – enterprises need file integrity monitoring, config drift detection, and restricted admin access for web infrastructure.
