Array AG DesktopDirect flaw exploited in Japan

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Attackers are exploiting a command injection flaw in Array Networks AG series DesktopDirect to deploy PHP webshells on Japanese systems since August 2025.

Sourceipa.go.jp — open the original

IPA (Japan's information security agency) has issued an alert regarding active exploitation of a command injection vulnerability in the DesktopDirect feature of Array Networks' AG series remote access appliances. Array Networks released a patched version in May 2025, but IPA reports that exploitation attempts believed to target this flaw have been observed in Japan since August 2025, several months after the fix was made available.

In observed incidents, attackers exploited the vulnerability to plant PHP webshells on affected systems, indicating post-exploitation persistence and potential for further compromise. The vulnerability affects systems where the DesktopDirect remote desktop access feature is enabled. IPA warns that exploitation could expand and urges organizations using the affected product to apply the vendor's patch immediately, noting that a reboot during patching may cause log loss — organizations are advised to preserve logs beforehand for forensic purposes. IPA also recommends organizations review logs for signs of prior compromise given confirmed in-the-wild exploitation.

IPA initially published a list of suspicious IP addresses associated with possible exploitation but later removed some after determining they belonged to legitimate overseas security research organizations conducting scans, underscoring the need for cautious IOC validation before action.

title: PHP Webshell Placement on Array Networks AG Appliance
description: Detects creation of PHP files in web-accessible directories on Array
  Networks AG appliances, typically observed after command injection exploitation
  of DesktopDirect. Targets file writes to common web roots without filtering legitimate
  administrative uploads.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .php
    TargetFilename|contains:
    - \var\www
    - \htdocs
    - \webroot
    - \html
  filter_legitimate_admin:
    Image|endswith:
    - \php.exe
    - \composer.exe
  condition: selection and not filter_legitimate_admin
falsepositives:
- Legitimate PHP application updates deployed via system administration tools
- Development or testing environments where PHP files are routinely created
level: high
id: 85916a7c-78a5-515d-9e7d-9f1af504af14
status: experimental
author: Vorant

title: Command Injection via DesktopDirect Web Interface
description: Detects process creation spawned from Array Networks AG DesktopDirect
  web service (typically running under httpd or service worker context) with command-line
  indicators of shell metacharacters or command chaining, suggesting post-injection
  code execution.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \httpd.exe
    - \nginx.exe
  selection_suspicious_cmd:
    CommandLine|contains:
    - '|'
    - '&'
    - ;
    - '`'
    - $(
  filter_legitimate_web_service:
    CommandLine|contains: backup
  condition: selection_parent and selection_suspicious_cmd and not filter_legitimate_web_service
falsepositives:
- Web service intentionally executing system utilities for diagnostics or backup operations
- Legitimate CGI scripts that deliberately use shell metacharacters
level: high
id: d94317c9-37c0-50c3-83ae-0ba985dd5dfb
status: experimental
author: Vorant

title: Suspicious Web Application File Modification on Array Networks AG
description: Detects writes to known web application configuration or script directories
  on Array Networks AG systems outside of expected patch/update windows. Targets modifications
  to application-critical files that could indicate webshell persistence or backdoor
  installation.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \desktopdir\
    - \cgi-bin\
    TargetFilename|endswith:
    - .php
    - .jsp
    - .asp
    - .aspx
  filter_patch_update:
    Image|endswith:
    - \setup.exe
    - \installer.exe
    - \msiexec.exe
  condition: selection and not filter_patch_update
falsepositives:
- Vendor patches or legitimate system updates modifying web application files
- Manual administration tasks updating application scripts
level: medium
id: 0dbb54ad-bc66-5269-b10f-6e1a4deca587
status: experimental
author: Vorant

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251208.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.