Threat Intelligence

Exposed Server Reveals Extortion Campaign Against Japanese Real Estate Websites

SOCRadar · 27 Oct 2026

Key Takeaway If your website shares hosting with other sites, treat one compromised neighbour as a risk to you: keep credentials and access keys out of web-accessible files, rotate them after any incident, and patch PHP promptly.

SOCRadar's Threat Research Unit found an open directory on a server that exposed the working files of an operator running an extortion campaign against Japanese real estate and property-buying websites in October 2026. The server held more than 3,800 files, including ransom pages, beacon logs, scripts for web shell deployment and lateral movement, and data stolen from victims. The ransom pages and contact addresses use the handle kkkkevin777.

The intrusions resembled a supply chain attack. After compromising the website of a Japanese real estate services company, the operator used access material found in that environment to reach nearly 20 other sites on the same shared hosting infrastructure and pull customer data. The stolen records include email addresses on major Japanese telecom, mobile and ISP mail domains, which puts those end users at risk of phishing and credential stuffing well beyond the breached sites.

The server also held a weaponized copy of the PHP2Shell reproducer package, linked to two unauthenticated PHP flaws. However, the files are dated October 21, about ten days after the extortion wave, and show no link between PHP2Shell and the earlier intrusions. They also contain no saved output showing a successful exploitation of a live site. SOCRadar notes that any PHP site running a vulnerable version should still be treated as exposed.

data breach extortion shared hosting supply chain threat intelligence

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.