China-Nexus Actors Chain PHP2Shell and Fragnesia Exploits Against Managed Firewalls

The operators first excluded servers in the US, Japan, Taiwan and South Korea running recent PHP builds, then launched the full exploit chain against the remaining pool. Twenty-four devices received a PHP root webshell; two belonging to the same organization were successfully retained. The first crashed immediately; the second allowed a reverse SSH tunnel that reached the internal management server holding configurations and credentials for every firewall the organization administered.

Technical indicators are limited to the exploit artifacts, FOFA queries, and post-exploitation sequence on the management host: LDAP password decryption, domain enumeration, password spraying, and attempted AD backdoor creation. No named group is attributed; Dream notes only that the four targeted countries align with documented Chinese strategic priorities in the Pacific. Independent confirmation of the specific CVEs or the Fragnesia kernel flaw remains absent from public vendor advisories.

The operation reveals a repeatable pattern: perimeter devices are no longer treated as throw-away footholds but as gateways to centralized management planes. Once inside the management server, attackers obtain the keys to an entire fleet rather than a single node. Similar reconnaissance and chaining activity should be expected against other firewall vendors whose management interfaces remain internet-reachable.

Next steps include monitoring for renewed FOFA-driven scans against additional vendors and checking whether the same automated tooling reappears against patched instances once public exploits surface.