Student Sells Gov't, University Sites to Chinese Actors

Researchers uncovered an operation in which a Bangladeshi college student monetized access to thousands (~5,200) of misconfigured websites (primarily in Asia) via Telegram, selling low-tier sites for a few dollars and high-value .edu/.gov targets for up to ~$220; purchasers—some likely conducting espionage—used a sophisticated, previously undocumented Chinese-language webshell called "Beima" that provides encrypted JSON C2, file upload/data theft, and timestamp manipulation to evade detection, with at least 80 sites observed hosting Beima.