Hackers are actively compromising NGINX servers in a stealthy traffic-hijacking campaign that silently redirects user requests through attacker-controlled infrastructure.
NGINX is widely used open-source software that manages web traffic, acting as a web server, load balancer, cache, and reverse proxy between users and backend systems.
According to researchers at DataDog Security Labs, the campaign targets NGINX deployments and Baota hosting management panels, primarily affecting websites using Asian top-level domains such as .in, .id, .pe, .bd, and .th, as well as government (.gov) and educational (.edu) domains.
Rather than exploiting a software vulnerability, attackers directly modify legitimate NGINX configuration files. They inject malicious location blocks that intercept requests to specific URL paths, rewrite them to include the full original URL, and forward the traffic using the proxy_pass directive to attacker-controlled servers.
Because proxy_pass is a standard feature commonly used for load balancing and backend routing, the abuse blends in with normal operations and does not trigger security alerts. Critical request headers—including Host, X-Real-IP, User-Agent, and Referer—are preserved to ensure the forwarded traffic appears legitimate.
The intrusion relies on a scripted, five-stage toolkit designed to safely alter NGINX configurations while minimizing disruption:
- Stage 1 (zx.sh): Acts as the main controller, downloading and executing subsequent stages. It can send raw HTTP requests over TCP if tools like curl or wget are unavailable.
- Stage 2 (bt.sh): Targets Baota-managed NGINX configurations, selects injection templates based on server_name, overwrites files safely, and reloads NGINX to avoid downtime.
- Stage 3 (4zdh.sh): Searches common configuration directories, uses parsing tools to prevent file corruption, detects prior injections via hashing, validates changes with nginx -t, and reloads the service.
- Stage 4 (zdh.sh): Focuses mainly on /etc/nginx/sites-enabled, with emphasis on .in and .id domains, using forced restarts as a fallback if reloads fail.
- Stage 5 (ok.sh): Collects data on hijacked domains, injected templates, and proxy targets, then exfiltrates the information to a command-and-control server at 158.94.210[.]227.
These attacks are particularly difficult to detect because user traffic often still reaches its intended destination, masking the fact that it has passed through attacker infrastructure. Unless NGINX configuration files and traffic flows are closely monitored, the compromise can remain unnoticed for extended periods.
Comments