From filemanager to frenzy: The rapid spread of MrRot_13’s cPanel DNS exploitation campaign

May 13, 2026 | Threat Intelligence Research

Active Exploitation Campaign Targeting cPanel Vulnerability CVE-2026-41940

TL;DR: Researchers attribute an ongoing exploitation campaign to the threat actor Mr_Rot13, targeting the critical cPanel authentication bypass vulnerability CVE-2026-41940. The campaign employs a backdoor named Filemanager to persistently access compromised Linux hosting environments and exfiltrate sensitive data.

Main Analysis:
Mr_Rot13 has been identified as a sophisticated threat actor involved in the exploitation of CVE-2026-41940, a critical vulnerability (CVSS score 9.8) in cPanel and WHM, which allows full admin access without credential requirements. The actor has utilized this vulnerability to execute automated attacks from over 2,000 unique source IP addresses globally. Their operations include not just initial exploitation but also secondary payload delivery involving cryptocurrency mining, botnet creation, and ransomware deployment.

The primary payload, named Filemanager, is a cross-platform backdoor that provides a variety of malicious functionalities, including remote command execution and file management. Once installed, it exposes a web-based management console that operates on an attacker-defined port, facilitating further exploitation and data exfiltration activities. Insights into the attack methodology reveal a sophisticated seven-phase automated infection chain, beginning with an authentication bypass and culminating in data exfiltration to command-and-control servers and Telegram channels.

Mr_Rot13 distinguishes itself from other attackers through a disciplined operational approach characterized by long-lived infrastructure and a focus on stealth. Their methods utilize established techniques, including the obfuscation of command-and-control addresses via the ROT13 cipher, legitimating the need for heightened vigilance among defenders in the hosting sector.

Defensive Context
Organizations operating cPanel or WHM are particularly vulnerable to this campaign, especially if they have not applied patches for CVE-2026-41940. Those that do not deploy these services, or manage alternate platforms, are likely at lower risk from this specific threat, but should remain aware of evolving tactics employed by sophisticated actors such as Mr_Rot13.

Why This Matters
The exploitation of CVE-2026-41940 can lead to severe repercussions, including unauthorized access to sensitive server data, potential disruption of services, and financial loss stemming from downtime or recovery efforts. Hosting providers and businesses using these services need to be particularly vigilant as they could be directly impacted by exploitation attempts.

Defender Considerations
Specific actions derived from the analysis include immediate patching of cPanel and WHM to the latest versions, and auditing of SSH access to identify any unauthorized alterations. The inclusion of network traffic monitoring specific to the identified attacker IPs and domains could facilitate early detection of similar attacks.

Indicators of Compromise (IOCs)
Key IOCs include: