Array AG DesktopDirect flaw exploited in Japan

Array Networks AG series appliances are being exploited via a command injection vulnerability in DesktopDirect, with webshell deployment observed in Japan since August 2025.

IPA Japan has issued an alert regarding active exploitation of a command injection vulnerability in Array Networks AG series remote access appliances. The vulnerability affects the DesktopDirect feature and allows attackers to execute arbitrary commands on vulnerable systems. Array Networks released patches in May 2025, but exploitation activity has been observed in Japan since August 2025.

Attackers are leveraging the vulnerability to deploy PHP webshells on compromised systems. IPA has identified specific IP addresses associated with the exploitation attempts, though notes that attribution based solely on these IPs is not conclusive. The agency recommends that organizations using affected Array AG products immediately investigate logs for signs of compromise before applying patches, as system reboots during patching may result in log loss.

IPA advises immediate patching to the latest versions and suggests organizations disable the DesktopDirect feature as a temporary mitigation if patching cannot be performed immediately. Organizations that identify communication with the suspicious IP addresses should report findings to IPA's Security Center.

title: Web Server Process Spawning Command Shell (Possible Webshell Execution)
id: cd6cbc7e-9449-5be3-9f00-1e1e3f9cb1fd
status: experimental
description: 'Detects a web server, PHP, or CGI process spawning a command interpreter
  (sh, bash, cmd.exe, powershell.exe), a common indicator of a webshell being used
  to execute attacker commands after exploitation of a public-facing application such
  as the Array AG DesktopDirect command injection vulnerability.

  '
references:
- IPA Japan alert on Array AG DesktopDirect exploitation
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - httpd
    - apache
    - apache2
    - nginx
    - php-fpm
    - php-cgi
    - php
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /csh
    - /perl
    - /python
    - /python3
  condition: selection_parent and selection_child
fields:
- ParentImage
- Image
- CommandLine
- User
falsepositives:
- Legitimate CGI scripts or web application features that intentionally invoke shell
  commands
- Administrative scripts executed manually from a web server context
level: high
tags:
- attack.t1505.003
- attack.t1059
- attack.t1190

title: PHP Webshell File Written to Web-Accessible Directory by Web Server Process
id: 9773b43c-3c3f-593d-ae0f-15e02a596690
status: experimental
description: 'Detects a web server or PHP-FPM process writing a new .php file into
  a commonly web-accessible directory, consistent with dropping a PHP webshell after
  exploiting a command injection vulnerability such as the Array AG DesktopDirect
  flaw.

  '
references:
- IPA Japan alert on Array AG DesktopDirect exploitation
author: Vorant
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith: .php
    Image|contains:
    - httpd
    - apache
    - apache2
    - nginx
    - php-fpm
    - php-cgi
  filter_deploy:
    TargetFilename|contains:
    - /vendor/
    - /composer/
  condition: selection and not filter_deploy
fields:
- Image
- TargetFilename
- User
falsepositives:
- Legitimate application deployments or updates writing PHP files via automated CI/CD
  pipelines
- Content management system plugin/theme installation through the web interface
level: medium
tags:
- attack.t1505.003
- attack.t1190

title: Command Injection Shell Metacharacters in HTTP Request to Remote Access Appliance
id: 4898d33e-776a-59bb-a171-c95fdb500010
status: experimental
description: 'Detects HTTP request URIs or query strings containing shell metacharacters
  combined with common command keywords (e.g. cat, wget, curl, chmod, bash) sent to
  remote access appliance web interfaces, consistent with exploitation of a command
  injection vulnerability such as the Array AG DesktopDirect flaw.

  '
references:
- IPA Japan alert on Array AG DesktopDirect exploitation
author: Vorant
logsource:
  category: proxy
  product: windows
detection:
  selection_meta:
    c-uri|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
  selection_cmd:
    c-uri|contains:
    - wget
    - curl
    - chmod
    - /bin/sh
    - /bin/bash
    - cat%20
    - base64
  selection_path:
    c-uri|contains:
    - desktopdirect
  condition: selection_meta and selection_cmd and selection_path
fields:
- c-uri
- cs-method
- c-ip
- cs-User-Agent
falsepositives:
- Vulnerability scanning or penetration testing activity against the appliance
- Automated security assessment tools probing the DesktopDirect endpoint
level: high
tags:
- attack.t1190
- attack.t1059

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251208.html