Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries

This report describes an exposed, actively assembled exploit server that hosted public and custom exploit code for multiple recent critical vulnerabilities (NGINX Rift, Ghost CMS SQLi, Splunk, Samba, WebLogic, PaperCut, D-Link NAS), included post-exploitation tooling (AdaptixC2, Supershell), and targeted high-value sectors across 11 countries using out-of-band DNS callback verification; IOCs and operator tradecraft are provided, but no confirmed successful compromises were recovered.