Sorry encrypts a cross-border e-commerce operator's cPanel servers

The client is a cross-border e-commerce operator running a cluster of independent storefronts. More than a dozen sites serving European, North American and Southeast Asian markets sat on several Linux servers in one data centre, all managed through cPanel / WHM, with site files and each store's MySQL database on the same host.

To let an outsourced development team and agency staff maintain the sites, the WHM management port and SSH were exposed directly to the internet, and the same administrative password was reused across servers. Panel upgrades were scheduled quarterly by the hosting supplier, and the patch for CVE-2026-41940 had never entered a change window after release.

The incident began early on a weekend morning in June. On-call staff first saw monitoring alerts: SSH was unreachable on several servers and every MySQL process was offline. Customer service then reported database connection errors across all storefronts. Logging in from the out-of-band console, engineers found files in both the web and data directories carrying .sorry appended to their complete original names, with a README.md written into every encrypted directory. The note was identical on every site, carried a single fixed Tox ID, and contained neither a per-victim code nor a payment address.

Backups were "panel-scheduled jobs written to a second partition on the same host, plus a weekly sync to offsite object storage". The on-host copies were encrypted with the servers; the offsite copy was four days old.

Containment instructions went out on the first call: keep the affected hosts powered but off both networks, do not reboot, reinstall or repair anything on the original disks, and block SSH between servers.

• Evidence and imaging. Read-only disk images of every affected host, plus panel and system logs, web logs and egress flow records. The original README.md and .sorry samples were preserved, and all later work ran on copies.
• Family confirmation and recoverability. The .sorry extension, a README.md with a fixed Tox ID in every directory, .sorry_ payloads under /tmp and outbound .onion traffic identified this wave's 64-bit Go Linux ELF. It encrypts whitelisted extensions end to end with no intact regions left, so page-level repair does not apply and no usable public decryptor exists; recovery was scoped to backups and log replay.
• Recovery execution. Site files came from the four-day-old offsite object storage copy; a read replica at a second cloud provider, outside the reach of this SSH spread, was the main database source, with unmatched binlogs on the primary replayed to bring the recovery point up to the encryption. Static assets came from the CDN and object storage, and orders were reconciled against the ERP / OMS copy.
• Hardening. Compromised hosts were rebuilt rather than cleaned and cPanel / WHM was upgraded inside a standing patch window. The panel and SSH moved off the public internet behind a jump host with allowlisting and multi-factor authentication, SSH moved to keys, and shared passwords were eliminated. Backups were rebuilt to a three-copy design with offline and immutable copies.
• Deliverables. A kill-chain timeline and compromised-host inventory, a statement of recovery scope and gaps, an exfiltration impact assessment with notification recommendations, and a hardening acceptance checklist. The report records both readings of the family's attribution - a new TellYouThePass variant to some vendors, a family new in 2026 to the national advisory.