Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches

Oasis Security analyzed breaches of two large South Korean churches where attackers used an ERP web shell, recovered configuration secrets to decrypt MSSQL/MariaDB credentials (including sa/root), leveraged xp_cmdshell and linked-server mappings for broad database and OS command execution, and escalated to SYSTEM via temporary services. The intrusions led to staged exports and exfiltration of large volumes of congregant, payroll, HR, and administrative data (hundreds of thousands of records and tens of gigabytes), reused previously leaked credentials, and exploited IDOR and SSO weaknesses; investigators recovered artifacts, an internet-accessible web shell, and an external staging IP.