https://www.theregister.com/2025/10/14/chinese_hackers_arcgis_backdoor/
Whomever the entity was that had their installation compromised violated a very standard rule of modern cyber security hygiene - NEVER, EVER, EVER allow an administrative interface to be exposed to the Internet.
Administrative access needs to be behind a VPN connection or at least a solid Multi Factor Authentication (MFA) setup for login. Both VPN + MFA is the preferred armor to your kingdom for any administrative credentials.
Tom
Please see the blog here on the ArcGIS Trust site: https://trust.arcgis.com/en/https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/understanding-arcgis-server-soe-compromise
Relevant statement:"Flax Typhoon leveraged valid credentials – reportedly a portal administrator account – to deploy the malicious extension."Seems less of a 'backdoor', as the title implies, and more of a compromised admin account.
Angemeldete Mitglieder können Beiträge verfassen, Updates folgen und mehr. Neu hier? Registriere ein kostenloses Konto.
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.
