9 minhigh
Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline
Operation Master compromised 7 VPN gateways via CVE-2026-0257, stole databases from 600+ companies, and deployed a multi-tenant invoice fraud platform targeting Brazilian energy consumers. The threat actor combined automated masscan reconnaissance, GlobalProtect auth-bypass exploitation, SQL injection, and OAuth device-code phishing to breach enterprise networks across four countries. Stolen data powered a multi-tenant fake-invoice platform on yzs.fi that dispatched 2.4M+ phishing messages via hijacked M365 mailboxes and SMPP gateways. AdaptixC2 provided persistent control over Windows servers; DNS tunneling and rclone handled exfiltration.
Sens:■ Immediate
IOCs48
14filename14sha2568cve7domain4ip1email
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Patch GlobalProtect gateways against CVE-2026-0257 and disable cookie-based re-authentication.
- Disable xp_cmdshell on all internet-reachable SQL Server instances.
- Block yzs.fi, igreenfaturas domains, and known C2 IPs on network controls.
- Review and revoke suspicious OAuth device-code grants in M365 tenants.
Key Takeaways
- CVE-2026-0257 exploited across 7 GlobalProtect gateways in four countries for VPN access.
- 277.5 million host scans curated 81 high-value targets via masscan with custom classifier.
- Fraud panel generated 622,666 personalized invoice links embedding R$150.4M in attempted fraud.
- DNS tunneling exfiltrated 24,558 debtor records via 470,268 queries from a SQL Server identity.
- Attribution links forum persona masterblack to email [email protected] across five operational contexts.
Attack Chain
- Initial Access: Exploits CVE-2026-0257 GlobalProtect auth bypass across 7 VPN gateways in four countries.
- Execution: SQL injection via xp_cmdshell triggers obfuscated PowerShell on SQL Server hosts.
- C2: Deploys AdaptixC2 gopher agents on Windows servers via XOR-wrapped shellcode delivery.
- Exfiltration: DNS subdomain tunneling and rclone cloud sync exfiltrate credential hives and databases.
- Monetization: Stolen data feeds multi-tenant fraud panel on yzs.fi generating 622,666 fake invoice links.
- Collection: Fraud payments routed through Vercel serverless PIX proxy after 2.4M+ phishing messages dispatched.
Affected Systems
- Palo Alto GlobalProtect gateways (non-SAML PAN-OS v1)
- Microsoft 365 tenant environments
- SQL Server instances with xp_cmdshell enabled
- Windows servers targeted for AdaptixC2 beacons
- ASP.NET applications with __VIEWSTATE injection
- GitLab instances vulnerable to CVE-2023-7028
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-0257 | Palo Alto Networks GlobalProtect | Critical | Authentication bypass enables forged VPN sessions on exposed gateways. |
| CVE-2022-28368 | dompdf | SSRF/LFI allows reading arbitrary server-side files via PDF rendering engine. | |
| CVE-2023-7028 | GitLab | Critical | Dual-email password reset abuse intercepts reset tokens without victim interaction. |
| CVE-2021-4034 | Linux (PwnKit) | High | Local privilege escalation via polkit pkexec exploit. |
| CVE-2024-1086 | Linux kernel (nf_tables) | High | Kernel exploit for local privilege escalation. |
| CVE-2020-1938 | Apache Tomcat (Ghostcat) | Medium | AJP client enables file read on Tomcat hosts. |
| CVE-2021-36260 | IP cameras | Vulnerability scanned for on internal IP cameras post-compromise. | |
| CVE-2022-40684 | Fortinet FortiOS | Critical | Authentication bypass probed against internal firewall interfaces. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Process spawning and registry access visible; beacon DLLs and DNS tunneling may evade standard signatures. |
| Network Visibility | Medium | DNS tunneling detectable via query analysis; legitimate M365 and Vercel abuse blends with normal traffic. |
| Detection Difficulty | Hard | Multi-vector operation abuses legitimate services; domainless phishing and DNS tunneling evade standard controls. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Database service processes spawning command interpreters indicate SQL-to-host execution chains (T1059.003). | Process creation logs showing sqlservr.exe spawning cmd.exe or PowerShell | Execution | Low — database services rarely spawn interactive shells |
| High-entropy DNS queries from server identities indicate DNS tunneling exfiltration (T1048.003). | DNS query logs from server IPs with subdomain length and entropy anomalies | Exfiltration | Medium — legitimate DNS can generate long subdomains |
| Institutional M365 mailboxes sending bulk external mail indicate compromised account abuse for phishing (T1566.002). | Mail flow logs showing volume spikes from education or healthcare tenants | Initial Access | Medium — legitimate bulk senders exist |
| OAuth device-code grants without corresponding device enrollment indicate phishing-based token capture (T1598). | Azure AD sign-in logs showing device-code auth without prior enrollment | Credential Access | Low — device-code flow without enrollment is unusual |
Required Log Sources
- Process creation logs (Sysmon EID 1)
- DNS query logs with subdomain length
- Azure AD sign-in and device-code logs
- Mail flow logs for volume anomalies
- SQL Server error and xp_cmdshell logs
- Network connection logs for C2 IPs
Key Behavioral Indicators
- sqlservr.exe spawning cmd.exe or powershell.exe processes
- High-entropy DNS subdomain queries to unknown authoritative resolvers
- rclone.exe or consumer cloud-sync clients on server hosts
- Beacon DLLs named wmsvc.dll or svc.dat in non-standard paths
- M365 mailboxes initiating over 10,000 external emails daily
- URL parameters ?ref=&venc=&v0= on lookalike energy invoice domains
Control Gaps
- Email gateways miss domainless phishing and OAuth device-code flows
- DNS monitoring likely misses subdomain-encoded data tunneling patterns
- Endpoint controls may not flag beacon DLLs loaded as service modules
- Cloud-sync detection absent for rclone on server hosts
- Service desk weak 4-character token validation allows session hijacking
False Positive Assessment
Low — IOCs include specific infrastructure, hashes, and domains tied to confirmed malicious activity with forensic corroboration.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy high-entropy DNS query detection for unknown resolvers and tunneling patterns.
- Alert on rclone or unauthorized cloud-sync clients appearing on server hosts.
- Monitor for bulk external email dispatch from institutional M365 mailboxes.
- Enforce minimum token length on internal service desk verification endpoints.
User Protection
- Alert on service identities accessing SAM, SYSTEM, or SECURITY registry hives.
- Detect sqlservr.exe spawning command interpreters via EDR process monitoring.
- Require 2FA on all Slack admin and owner accounts.
- Monitor for ntds.dit access by non-domain-controller processes.
Security Awareness
- Classify unsolicited PIX invoice communications as fraudulent by default.
- Brief employees that legitimate support never requests itsme codes by phone.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping30 techniques
Tactic
Reconnaissance
Tactic
Resource Development
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Tactic
Impact
Plain-Language Summary
A hacker group broke into corporate networks by exploiting a VPN security flaw and database weaknesses, stealing customer records from over 600 companies. They used the stolen data to create a fake invoice system that sent millions of phony energy bills to Brazilian consumers, tricking them into paying via instant transfer. The operation ran from April to September 2026 before being exposed. Organizations should patch VPN gateways, restrict database commands, and watch for unusual email sending patterns.
Additional IOCs
- Ips:
91[.]92[.]241[.]184- Shifted operation server IP before move to .187
- Domains:
igreenfaturas[.]com- First-generation lookalike domain impersonating iGreen Energianuvfaturas[.]com- Fake invoice host for NUV energy tenantqrcode[.]a55scd[.]com[.]br- Dynamic PIX QR code generation service for fraud
- File Hashes:
c40c1d4bb0e01f217c893f3dbc6b40802a260ef423f628889a48f996a4c96ed8(SHA256) - beacon_db01.dll (wmsvc.dll) database-server beacon2553146aea0b133d565684a8bdfb14cb91526eb88b4e5b22b129b1212f763dd7(SHA256) - beacon_db2.dll secondary C2 beacon DLL6394cb167a33772fc47596e22cd2a51f3dfa9867385d962cb700b78f021c60ca(SHA256) - gopher_orig.exe earlier config AdaptixC2 agent0c36cf593cf177b87f34abb19b5d65619199a4aca9c8e19e39318ad2c4033385(SHA256) - shell.war Linux JSP command-execution webshellfd72014903466f2abcabb724df58682e629bf300703a06dad4dd0551018a42b5(SHA256) - ws.war Windows JSP command-execution webshell39aab72976d63f0218c3470c05afce5a896d28f860efaa598288d9409499b26b(SHA256) - payload.war Metasploit WAR payload for Tomcat9a839b1e4c8cc5c0ebac1849973f136e68aae8eba357296be9e6cef9aff35ae6(SHA256) - loader_v2_final.c FUD Loader v2 evasion source88527b06d836200a36130ee219242e4a8342520df85cb3886769da646dac25c9(SHA256) - agent_fud_raw.elf Linux FUD agent binary2ced60c88f5a2b36acb977ebf120e39b527dcff07b5072013350ebeefcabe760(SHA256) - sc_fud_new.bin AES-encrypted FUD shellcode payload0b6bb51ef917c32edf75ff65a510b6a136575cfd2075305f7abe7d98e351b8b8(SHA256) - svc.dat fourth beacon DLL variant HTTP connectoreda93a71e656874077aa76d32d5147ea904ef60504b6b1b22b609969c06fb40b(SHA256) - .x11d hidden Linux gopher agent dot-file buildf9b147a2bf6cc53ed4e3c3d4d33efa072c19495ff86fa320a280097d66cb2d92(SHA256) - rc_chunk_aa unresolved PE chunk component
- File Paths:
gopher_new.exe- AdaptixC2 Windows Go agent with BOF loadinggopher_orig.exe- Earlier AdaptixC2 Windows agent variantbeacon.dll- x64 HTTP-connector beacon DLL for Windowsbeacon_db01.dll- Database-server beacon DLL variantwmsvc.dll- Alias name for beacon_db01.dll beaconbeacon_db2.dll- Secondary beacon DLL variant for Windowssvc.dat- Fourth beacon DLL variant HTTP connectoragent_fud_raw.elf- Linux FUD agent ELF binary.x11d- Hidden Linux gopher agent dot-file nameshell.war- Linux JSP command-execution webshell WARws.war- Windows JSP command-execution webshell WARpayload.war- Metasploit-generated WAR payload for Tomcatsc_fud_new.bin- AES-encrypted shellcode payload blobloader_v2_final.c- FUD Loader v2 C source with evasion techniquesgsn- Custom SSL helper likely tunnel or shell component
- Command Lines:
- Purpose: Execute commands via SQL Server xp_cmdshell to run obfuscated PowerShell for host-level execution | Tools:
xp_cmdshell,PowerShell| Stage: Execution |xp_cmdshell - Purpose: Probe internal Fortigate firewalls for auth bypass across gateway subnets | Tools:
curl| Stage: Lateral Movement |curl -sk https://<host>:64443/api/v2/cmdb/system/admin?access_token= - Purpose: Load malicious Redis module to initiate reverse shell to operator listener | Tools:
redis-cli,python3| Stage: Lateral Movement |redis-cli -h <host> -p 6380 MODULE LOAD - Purpose: Sync stolen data to cloud storage via rclone without intermediate server | Tools:
rclone| Stage: Exfiltration |rclone sync
- Purpose: Execute commands via SQL Server xp_cmdshell to run obfuscated PowerShell for host-level execution | Tools:
Showing defanged values
- cveCVE-2020-1938AJP client enables file read on Tomcat hosts.
- cveCVE-2021-36260Vulnerability scanned for on internal IP cameras post-compromise.
- cveCVE-2021-4034Local privilege escalation via polkit pkexec exploit.
- cveCVE-2022-28368SSRF/LFI allows reading arbitrary server-side files via PDF rendering engine.
- cveCVE-2022-40684Authentication bypass probed against internal firewall interfaces.
- cveCVE-2023-7028Dual-email password reset abuse intercepts reset tokens without victim interaction.
- cveCVE-2024-1086Kernel exploit for local privilege escalation.
- cveCVE-2026-0257Authentication bypass enables forged VPN sessions on exposed gateways.
- domainigreenfaturas[.]comFirst-generation lookalike domain impersonating iGreen Energia
- domainigreenfaturas[.]toFake invoice host for iGreen Energia tenant
- domainnuvfaturas[.]comFake invoice host for NUV energy tenant
- domainpix-proxy-sable[.]vercel[.]appVercel serverless proxy for PIX payment fraud routing
- domainqrcode[.]a55scd[.]com[.]brDynamic PIX QR code generation service for fraud
- domainwattiofaturas[.]comFake invoice host for Wattio energy tenant
- domainyzs[.]fiMain fraud panel application and admin domain
- emailcyberkill2025[@]gmail[.]comThreat actor primary email linked to forum persona masterblack
- filenameagent_fud_raw.elfLinux FUD agent ELF binary
- filenamebeacon_db01.dllDatabase-server beacon DLL variant
- filenamebeacon_db2.dllSecondary beacon DLL variant for Windows
- filenamebeacon.dllx64 HTTP-connector beacon DLL for Windows
- filenamegopher_new.exeAdaptixC2 Windows Go agent with BOF loading
- filenamegopher_orig.exeEarlier AdaptixC2 Windows agent variant
- filenameloader_v2_final.cFUD Loader v2 C source with evasion techniques
- filenamepayload.warMetasploit-generated WAR payload for Tomcat
- filenamesc_fud_new.binAES-encrypted shellcode payload blob
- filenameshell.warLinux JSP command-execution webshell WAR
- filenamesvc.datFourth beacon DLL variant HTTP connector
- filenamewmsvc.dllAlias name for beacon_db01.dll beacon
- filenamews.warWindows JSP command-execution webshell WAR
- filename.x11dHidden Linux gopher agent dot-file name
- ip185[.]242[.]3[.]14Earlier server and original home of yzs.fi domain
- ip85[.]120[.]216[.]8First exploitation server with fraud panel on port 3000
- ip91[.]92[.]241[.]184Shifted operation server IP before move to .187
- ip91[.]92[.]241[.]187Latest C2 and operation server hosting AdaptixC2
- sha2560b6bb51ef917c32edf75ff65a510b6a136575cfd2075305f7abe7d98e351b8b8svc.dat fourth beacon DLL variant HTTP connector
- sha2560c36cf593cf177b87f34abb19b5d65619199a4aca9c8e19e39318ad2c4033385shell.war Linux JSP command-execution webshell
- sha2562553146aea0b133d565684a8bdfb14cb91526eb88b4e5b22b129b1212f763dd7beacon_db2.dll secondary C2 beacon DLL
- sha2562ced60c88f5a2b36acb977ebf120e39b527dcff07b5072013350ebeefcabe760sc_fud_new.bin AES-encrypted FUD shellcode payload
- sha25639aab72976d63f0218c3470c05afce5a896d28f860efaa598288d9409499b26bpayload.war Metasploit WAR payload for Tomcat
- sha25654caa256483876debd21c264bfc31bd96f925b2167f6d9358ab7ee0c87e6e37bgopher_new.exe custom AdaptixC2 Go agent binary
- sha2566394cb167a33772fc47596e22cd2a51f3dfa9867385d962cb700b78f021c60cagopher_orig.exe earlier config AdaptixC2 agent
- sha25688527b06d836200a36130ee219242e4a8342520df85cb3886769da646dac25c9agent_fud_raw.elf Linux FUD agent binary
- sha2569a839b1e4c8cc5c0ebac1849973f136e68aae8eba357296be9e6cef9aff35ae6loader_v2_final.c FUD Loader v2 evasion source
- sha256c40c1d4bb0e01f217c893f3dbc6b40802a260ef423f628889a48f996a4c96ed8beacon_db01.dll (wmsvc.dll) database-server beacon
- sha256d566ccdd099b0decb7e7288c20097f34da2613e3ffe8c5acbc1a1d01b6fe217cbeacon.dll x64 C2 beacon DLL for Windows hosts
- sha256eda93a71e656874077aa76d32d5147ea904ef60504b6b1b22b609969c06fb40b.x11d hidden Linux gopher agent dot-file build
- sha256f9b147a2bf6cc53ed4e3c3d4d33efa072c19495ff86fa320a280097d66cb2d92rc_chunk_aa unresolved PE chunk component
- sha256fd72014903466f2abcabb724df58682e629bf300703a06dad4dd0551018a42b5ws.war Windows JSP command-execution webshell
Related
- Arctic Wolf Observes an Increase in Palo Alto Networks GlobalProtect Authentication Bypass Exploitation via CVE-2026-0257·2
- A Miner Was Only the First Clue: From Docker to Hermes and AdaptixC2Engagement·1
- Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use·1