OTX Threat: Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers

A threat actor compromised three web servers hosting recreation management software for municipalities and parks organizations by exploiting a file upload vulnerability. After multiple failed exploitation attempts, the attacker registered legitimate accounts and abused the member file upload function to deploy webshells. The attacker enumerated systems, extracted database credentials, and targeted CVEs: CVE-2025-26399 Sectors: Government