Student Sells Gov't, University Sites to Chinese Actors

Asian threat actors have been buying access to misconfigured government, university and other high-value websites at relatively low prices, with researchers noting a broader ecosystem on Telegram channels selling compromised sites. According to Cyderes' Howler Cell, a college student in Bangladesh has been selling access to vulnerable sites for three or four dollars each, and around $200 for larger targets such as universities, law enforcement, and government bodies.

The seller collects more than 5,200 sites in total, with about 72% concentrated in Asia, and nearly half coming from the education sector and a quarter from the government sector, suggesting buyers who are often Chinese, Malaysian, and Indonesian. The operation has seen the Beima webshell deployed on at least 80 observed sites, a tool described as high-grade and capable of uploading malware and performing command-and-control activities, while remaining undetectable by modern security tools.

The findings underscore a marketplace where district and university-level access can be monetised for espionage or broader cybercrime, according to Cyderes' Howler Cell.