Loading story…
Attackers breached a public RDWeb/RD Gateway terminal server using a valid domain credential that lacked MFA, then used the host to stage a large phishing operation. Huntress found the intrusion shortly after onboarding a 25-endpoint customer and linked the primary access to Romanian-source IPs 80.94.95[.]37 and 212.93.152[.]37, which authenticated to the exposed portal, downloaded the published .rdp file, and reconnected to an existing RDP session. A separate US-based brute-force source, 216.152.151[.]168, also guessed the same weak password but did not appear to use the access.
On the server, the actor deployed Gammadyne Mailer (gm.exe) with a long-lived project file and six recipient lists containing 8,894,920 addresses, then launched a Boots-themed phishing campaign offering a fake free-gift survey. The emails directed victims to hxxps://ipelc.gob[.]bo/boots_store/, a phishing kit hosted on a compromised Bolivian government domain, and were delivered directly to recipient mail servers over SMTP rather than through the victim organization's mail tenant. After the host was isolated, it generated 29,954 blocked outbound SMTP connection attempts to 1,641 recipient mail servers in 104 seconds; Huntress isolated all endpoints, advised a password reset for the compromised account, and notified Bolivia's national CSIRT about the abused government site.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
After identifying the abuse, Huntress mass-isolated all 25 endpoints and alerted the partner to reset the compromised account. Huntress also notified Bolivia's national CSIRT, CGII/AGETIC, that the government site hosting the phishing kit had been compromised.
On the compromised server, the actor deployed and ran Gammadyne Mailer with a long-lived project file and six recipient lists totaling 8,894,920 addresses. The campaign impersonated Boots UK and sent victims to a phishing kit hosted at ipelc.gob.bo on a compromised Bolivian government domain.
Before Huntress onboarding, attackers accessed a public RDWeb/RD Gateway terminal server using a valid domain credential on an account that did not have MFA enabled. Huntress tied the intrusion primarily to Romanian-source IPs that logged into the exposed RDWeb portal and reconnected to an existing RDP session.
Huntress investigated an intrusion discovered within hours of onboarding a 25-endpoint customer. The investigation found the terminal server had already been compromised and was being used for direct-to-MX phishing delivery over TCP port 25.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026