[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc4uqLVRghNk3uGjfCOxbQZdxoT85xSP1IbhCm8mu_Xo":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":110},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"00aaa490-e17a-438d-90f2-0c2c36770e54","Attacker signs up as a member to plant webshells on parks and recreation platform, hunts for card data","attacker-signs-up-as-a-member-to-plant-webshells-on-parks-and-recreation-platfor-a5bab7","Security researchers at Huntress have detailed a multi-stage intrusion in which a threat actor compromised three web servers belonging to a popular recreation management platform used by local municipalities and parks organisations, planting webshells and going after payment card data. The activity, first observed on 10 September 2026, began noisily. Over roughly six hours the […] The post Attacker signs up as a member to plant webshells on parks and recreation platform, hunts for card data appeared first on IT Security Guru.","Threat actors compromised three web servers of a recreation management platform used by local municipalities and parks organizations. The attackers gained access by signing up as members, then planted webshells to gain further control and search for payment card data. The intrusion was first observed on September 10, 2026.","Attacker joins recreation platform as member to plant webshells and steal card data.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F30\u002Fattacker-signs-up-as-a-member-to-plant-webshells-on-parks-and-recreation-platform-hunts-for-card-data\u002F?utm_source=rss&utm_medium=rss&utm_campaign=attacker-signs-up-as-a-member-to-plant-webshells-on-parks-and-recreation-platform-hunts-for-card-data",null,"2026-09-30T15:26:22+00:00","2026-09-30T16:00:35.799427+00:00",7,[17,20],{"name":18,"type":19},"webshells","product",{"name":21,"type":22},"Huntress","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":12,"name":25,"slug":26},"Breaches","breaches",[28,30,35,40],{"category":29},{"id":23,"icon":12,"name":25,"slug":26},{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":48,"vendors":104},[49,75],{"slug":50,"name":51,"problem":52,"products":53},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":71,"product_name":72,"url":73,"description":74},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":76,"name":77,"problem":78,"products":79},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[105],{"slug":106,"name":21,"logo_path":107,"roles":108},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[109],"reported_by",{"slug":111,"title":112,"body":113,"framework_refs":114,"framework_notes":127},"self-registration-exploit-leads-to-webshell-implant-on-municipal-recreation-platform","Self-Registration Exploit Leads to Webshell Implant on Municipal Recreation Platform","Attackers exploited an open self-registration feature on a recreation management platform to gain an initial foothold as legitimate members, then escalated access by planting webshells across three web servers. This attack highlights the danger of treating public-facing registration forms as low-risk entry points — once inside, attackers pivoted to hunt for payment card data affecting municipalities and parks organizations. The incident underscores that any authenticated access path, even one designed for general public use, can be weaponized if not properly hardened and monitored. Payment card data stored or processed on platforms with weak access controls creates significant financial and regulatory exposure for the organizations relying on them.",[115,116,117,118,119,120,121,122,123,124,125,126],"CIS Control 4 - Secure Configuration of Enterprise Assets","CIS Control 6 - Access Control Management","CIS Control 10 - Malware Defenses","CIS Control 13 - Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity)","NIST SP 800-53 AU-6 (Audit Record Review and Analysis)","PCI DSS Requirement 6.4 (Web-Facing Application Protection)","PCI DSS Requirement 10.2 (Audit Log Events)","OWASP Top 10 A01:2021 - Broken Access Control","OWASP Top 10 A05:2021 - Security Misconfiguration",{}]