GCVE-110-OSM-2026-1202

Tenth package in the ozaduliqitu21@gmail.com Strapi credential harvesting campaign. Postinstall brute-forces Elasticsearch at 65.21.203.242:9200 using 8 hardcoded credentials including 'elastic:Guardarian123', then dumps all transaction, wallet, payment and deposit indices. Exfiltrates all data to attacker C2 at 144.31.107.231:9999 via HTTP POST. Also escapes container via /proc/1/root to read elasticsearch.yml and .env files from the host. postinstall.js iterates 8 ES credential combinations via curl against 65.21.203.242:9200. On auth success: exfiltrates _cat/indices, _cluster/health, and searches *transaction*/*wallet*/*payment*/*deposit* indices. Scans adjacent Hetzner IPs 65.21.203.241-245 for additional ES nodes. Reads host ES config via /proc/1/root container escape. Same send() chunked-POST exfil function as the 9 previously submitted campaign packages.