Loading story…
CloudSEK reported that an exposed server uncovered a Russian-speaking initial access broker running a large-scale intrusion operation against internet-facing appliances and public applications across more than a dozen countries. From mid-2025 into late 2026, the actor used public and modified proof-of-concept exploits to compromise organizations in education, healthcare, finance, telecommunications, government, managed services, and other enterprise sectors, then deployed web shells and tunnels, stole credentials, exfiltrated device configurations and cloud backups, and in some cases achieved full Active Directory compromise by obtaining material needed to forge Kerberos tickets.
The investigation found that several victims were later claimed by different ransomware groups within weeks, indicating the actor likely sold network access rather than conducting extortion directly. CloudSEK also said the same infrastructure was later used for targeted collection against Ukrainian defence and aerospace entities, including theft from exposed source-code repositories, use of Sliver C2, and collection of imagery and activity from exposed IP cameras and RDP sessions, suggesting an overlap between criminal access brokerage and activity aligned with Russian state-linked intelligence requirements.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
CloudSEK linked the camera-surveillance tradecraft in the Ukraine-focused activity to a July 2026 advisory from AIVD and MIVD about Russian state actors compromising IP cameras to identify military vehicles and cargo. This advisory served as an external reference point for the observed collection behavior.
The report states that ransomware group Tengu claimed MARTEC MARINE on its leak site the month after the operator's access. This was presented as evidence that the actor likely sold access to downstream extortion actors.
Late in the timeline, the same infrastructure was used for targeted collection against Ukrainian defence and aerospace organizations, including Sliver C2 deployment, theft of exposed Git repositories and source code, and collection of imagery from internet-facing IP cameras and exposed RDP sessions. CloudSEK assessed this phase with moderate-to-high confidence as aligned with state-linked intelligence requirements.
CloudSEK identified MARTEC MARINE as a victim where the operator forged a Kerberos golden ticket, confirming theft of krbtgt material and full domain compromise. The report explicitly anchors this event to January 2026.
CloudSEK reported that an exposed server contained timestamped, command-level records showing a Russian-speaking initial access broker conducting large-scale exploitation campaigns across multiple countries. The activity was explicitly described as spanning from mid-2025 into late 2026.
CloudSEK published findings on an exposed server that revealed a Russian-speaking initial access broker's broad intrusion activity and later Ukraine-focused espionage collection. The report assessed that the actor primarily sold access to ransomware operators while also supporting intelligence-oriented collection on the same infrastructure.
CloudSEK reported that Greater Pittsburgh Orthopaedic Associates appeared in the exposed directory as a confirmed domain compromise involving harvested administrative credentials, DPAPI backup keys, and dumped credential stores, and that RansomHouse later claimed the organization on its leak site. No explicit date was provided for either the compromise or the later claim.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (**SVR**), also tracked as **APT29** and **Nobelium**, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including `CVE-2019-19781`, `CVE-2019-11510`, `CVE-2018-13379`, and `CVE-2020-5902`, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains. The campaign builds on tradecraft previously tied to the **SolarWinds Orion** compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as **SUNBURST**, **TEARDROP**, **Cobalt Strike Beacon**, and **WELLMESS**. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Aug 15, 2026
CloudSEK disclosed a coordinated intrusion campaign dubbed **Operation Escaneo** that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing **Fortinet FortiOS SSL-VPN**, **Ivanti Connect Secure**, and **Apache Tomcat** systems, while also maintaining capabilities for `EternalBlue`, `Zerologon`, `GhostCat`, `Log4Shell`, and `PwnKit`. CloudSEK attributed the activity with medium confidence to **MexicanMafia**, also tracked as **PanchoVilla**, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations. The attackers used a custom reconnaissance framework called **Kimera**, **Neo-reGeorg** web shells, **Chisel** reverse tunnels, and persistence on compromised Cisco routers through **GRE tunnels** to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as **RDP**, **PsExec**, and **Impacket** for lateral movement and privilege escalation. Reported theft included a **407 MB BloodHound** Active Directory dataset, more than **1.3 million personal records**, and **SSL private keys**, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Jun 29, 2026