An attack campaign using the Drupalgeddon2 unauthenticated remote code execution vulnerability to execute malicious code and deface websites. In the case analyzed for their blog, Akamai researchers identified a compromised bodysurfing website logging website requests containing code execution attempts. After cleaning up old infections and reducing a web server’s security posture, the code is used to download two files, a GIF image and a TXT file. The GIF image has the appropriate GIF header but is actually used to execute embedded PHP code. The PHP code first performs website defacement and displays a notification of the infection to visitors to the site. Hidden behind this defacement page are functions that allow the attacker to execute various commands via GET or POST requests, such as scanning for local credentials, getting system configurations, and opening a web shell. The TXT file downloaded in the initial infection contains a malicious Perl script. It provides the attacker with denial of service (DoS) and RAT capabilities. For command and control, it leverages an IRC server that has since been taken down. The researchers note that the attack seems to be more opportunistic than targeted.