Loading story…
An allegedly exposed server tied to the French-speaking BlackHatSect0r && DXQRTXX cybercrime crew hosted DXSCAN, a Go-based platform for mass IP scanning and credential harvesting, alongside phishing, extortion, and data-monetization tooling. The infrastructure also reportedly contained an AI-agent framework with safety refusals disabled and a vault holding 16,834 harvested credentials. Researchers distinguish the crew from its publicly facing affiliate, APT-90.
The group allegedly targeted or compromised French organizations and government services, New York public bodies, and a cryptocurrency exchange, and conducted a vishing operation impersonating Société Générale against older French telecom subscribers. Its observed activity relied largely on active scanning and exploitation of exposed cloud buckets, publicly accessible .env and Git files, weak or default JWT secrets, and client-exposed cryptographic material—not zero-day exploits—while using leased server infrastructure consistent with common adversary VPS-supported scanning, phishing, and credential-theft operations. Organizations should prioritize exposure management, storage access controls, secret rotation, JWT hardening, and remediation of publicly exposed development artifacts.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
The group allegedly used a French telecom subscriber dataset containing 449,970 records for a vishing campaign impersonating Société Générale. The campaign sent 672 fraudulent debit-alert messages to 668 recipients over 85 minutes using hijacked SMTP relays and SendGrid sender identities.
A Laravel-based cryptocurrency exchange allegedly used the literal JWT signing secret "secret," allowing forged administrator tokens and exposure of 418 KYC records. Tooling attempted to disable withdrawal protections and transfer funds to actor-controlled wallets, but no funds moved because targeted accounts lacked withdrawable balances.
The group allegedly targeted ANTAI and amendes.gouv.fr using F5 BIG-IP reconnaissance, JWT-forgery attempts, request smuggling, SSRF, and brute-force tooling. Its toolset shortlisted several genuine but long-patched F5 BIG-IP vulnerabilities and incorrectly categorized the TeamCity flaw CVE-2024-27198 as an F5 vector.
An alleged extortion portal targeted the Dormitory Authority of the State of New York, New York Power Authority, Port Authority of New York and New Jersey, and New York City Small Business Services. The operation demanded 2 BTC and claimed exfiltration, encryption, and defacement of 67 S3 buckets; these were actor claims.
The crew publicly claimed to have taken files, Git history, an application .env file, and SMTP credentials from France's National Mountain Observation System (SNOSM).
BlackHatSect0r && DXQRTXX publicly claimed it compromised the French Equestrian Federation by accessing publicly available OVH S3 buckets and exposed application data.
Researchers reported that the operator used a Nous Research Hermes agent with a DeepSeek model and modified its identity and memory files to remove refusal behavior. Artifacts reportedly included SOUL.md, a .hermes directory, HERMES_DISABLE_SAFETY=1, and ghost_-prefixed processes.
The exposed infrastructure allegedly hosted the custom Go-based DXSCAN C2 v1.0 platform, which scanned targets for exposed credentials and queued 2,759,860 domains. Researchers reported 726,989 reached hosts and a vault containing 16,834 harvested credential entries, including cloud, database, SMTP, API, and source-control secrets.
Researchers attributed an allegedly exposed operation server to the French-speaking BlackHatSect0r && DXQRTXX crew, distinguishing APT-90 as a public-facing alliance and amplification partner. The recovered environment reportedly contained about 4.9 GB across 9,299 files and identified alleged active and retired C2 nodes in AlexHost SRL address space.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CloudSEK disclosed a coordinated intrusion campaign dubbed **Operation Escaneo** that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing **Fortinet FortiOS SSL-VPN**, **Ivanti Connect Secure**, and **Apache Tomcat** systems, while also maintaining capabilities for `EternalBlue`, `Zerologon`, `GhostCat`, `Log4Shell`, and `PwnKit`. CloudSEK attributed the activity with medium confidence to **MexicanMafia**, also tracked as **PanchoVilla**, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations. The attackers used a custom reconnaissance framework called **Kimera**, **Neo-reGeorg** web shells, **Chisel** reverse tunnels, and persistence on compromised Cisco routers through **GRE tunnels** to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as **RDP**, **PsExec**, and **Impacket** for lateral movement and privilege escalation. Reported theft included a **407 MB BloodHound** Active Directory dataset, more than **1.3 million personal records**, and **SSL private keys**, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Jun 29, 2026
Researchers exposed a major **OPSEC failure** by **FancyBear**/**APT28** that revealed an active espionage operation, tracked as **Operation Roundish**, targeting government and military organizations across Europe. An exposed **NameCheap VPS** at `203.161.50.145`, previously linked to the group by **CERT-UA**, remained in use for more than 500 days and contained a publicly accessible directory with stolen data and operational artifacts. Hunt.io first documented the campaign from an exposed directory scan, and follow-on analysis found the same infrastructure held **2,800+ exfiltrated emails**, **240+ stolen credential sets** including passwords and **TOTP 2FA secrets**, **140+ malicious email-forwarding rules**, and **11,500+ harvested contact addresses** from victim mailboxes. Further investigation uncovered a second exposed directory on the same server containing **FancyBear’s C2 source code**, additional JavaScript payloads, telemetry logs, and evidence of broader collection activity. The operation affected entities in **Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia**, including addresses associated with **four NATO member states** and NATO-linked targets. Researchers also reported a previously unreported **SquirrelMail XSS payload**, indicating the campaign targeted multiple webmail platforms and used mailbox compromise, silent forwarding, and credential theft to sustain long-term intelligence collection.
Jun 29, 2026
Black Basta affiliates used a multi-stage social-engineering campaign to breach corporate networks by impersonating IT support staff in **Microsoft Teams** and persuading employees to grant remote access through **Windows Quick Assist** and **AnyDesk**. Researchers said the attacks often began with email bombing to overwhelm targets, followed by Teams chats or calls from attacker-controlled external Entra ID tenants using names such as "Help Desk" or "support." In earlier incidents, the group similarly abused Quick Assist after contacting victims by phone, showing a consistent pattern of using legitimate remote-support tools to gain initial access. After access was established, the attackers deployed additional tooling including **ScreenConnect**, **NetSupport Manager**, **Cobalt Strike**, and **SystemBC**-linked payloads, while also using credential-theft and lateral-movement activity such as accessing **LSASS**, scanning internal hosts, and running **Impacket `secretsdump.py`**. ReliaQuest also observed malicious QR-code lures tied to domains such as `qr-s1[.]com` through `qr-s4[.]com`, and a VBS-based infection chain that contacted `179.60.149[.]194` to retrieve follow-on payloads. The activity was attributed to Black Basta with high confidence, with reporting indicating infrastructure and Teams activity linked to Russia, and defenders were urged to restrict external Teams communications, limit trusted domains, and improve Teams, email, and remote-access monitoring.
Aug 14, 2026