Loading story…
SOCRadar reported that the alleged Operation Master cybercrime operation chained enterprise intrusion, data theft, underground data sales, and invoice fraud. Active from April through mid-September 2026, the operators reportedly exploited Palo Alto Networks GlobalProtect authentication-bypass flaw CVE-2026-0257, alongside SQL-injection and other web attacks, to compromise seven gateways across four countries and exfiltrate data from at least nine databases. The group allegedly used AdaptixC2, DNS tunneling, staged SFTP transfers, and rclone cloud synchronization for command-and-control and data theft, then sold stolen customer and billing records under the “masterblack” persona.
The stolen data was reportedly repurposed into a Brazilian utility-bill impersonation platform that created personalized payment links and distributed an estimated 2.4 million email and SMS messages, with additional WhatsApp lures reported. The campaigns used stolen customer details and mirrored invoices to drive PIX payments through attacker-controlled infrastructure. SOCRadar assessed with high confidence that “masterblack” and cyberkill2025@gmail.com were tied to a principal operator; while the infrastructure went offline in mid-September, investigators could not determine whether the operation ended or relocated.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
By September 16, the fraud panel recorded 2,468,335 emails and 1,487,294 SMS messages sent using hijacked Microsoft 365 mailboxes and messaging gateways. Logged invoice values totaled R$150.4 million, though this did not establish that attackers received the funds.
By September 14, the master-panel invoice-fraud platform had generated 622,666 personalized short links and recorded 317,696 click events. The platform impersonated utility brands and used email, SMS, and WhatsApp to deliver fraudulent invoice links.
The exposed infrastructure associated with Operation Master went offline in mid-September 2026. Investigators could not determine whether the operation had ceased or moved to new infrastructure.
Operation Master began operating in April 2026, combining enterprise-network intrusion, theft of customer data, and utility-invoice fraud primarily targeting Brazilian customers.
SOCRadar linked the masterblack persona and cyberkill2025@gmail.com to sales of stolen Wattio Energy and iGreen Energy data. The stolen customer and billing data was subsequently used to personalize utility-invoice phishing campaigns.
The operators exploited CVE-2026-0257 to establish unauthorized VPN sessions through seven GlobalProtect gateways in four countries. They also used automated SQL injection against at least nine database systems and exfiltrated data, including 24,558 debtor records from a Brazilian energy-billing system via DNS tunneling.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CloudSEK disclosed a coordinated intrusion campaign dubbed **Operation Escaneo** that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing **Fortinet FortiOS SSL-VPN**, **Ivanti Connect Secure**, and **Apache Tomcat** systems, while also maintaining capabilities for `EternalBlue`, `Zerologon`, `GhostCat`, `Log4Shell`, and `PwnKit`. CloudSEK attributed the activity with medium confidence to **MexicanMafia**, also tracked as **PanchoVilla**, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations. The attackers used a custom reconnaissance framework called **Kimera**, **Neo-reGeorg** web shells, **Chisel** reverse tunnels, and persistence on compromised Cisco routers through **GRE tunnels** to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as **RDP**, **PsExec**, and **Impacket** for lateral movement and privilege escalation. Reported theft included a **407 MB BloodHound** Active Directory dataset, more than **1.3 million personal records**, and **SSL private keys**, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Jun 29, 2026
SOCRadar reported a long-running phishing operation dubbed **Operation DoppelBrand**, attributed to a financially motivated actor tracked as **GS7**, that uses high-fidelity replicas of Fortune 500 and major consumer brands to harvest credentials and enable follow-on access. The activity observed most recently (Dec 2025–Jan 2026) impersonated major financial and technology organizations (including **Wells Fargo, USAA, Navy Federal Credit Union, Fidelity, Microsoft, and Citibank**) and relied on a highly automated domain and infrastructure pipeline, with researchers identifying **hundreds of malicious domains** and **150+ newly identified domains** following consistent patterns. The operation is assessed as monetization-focused, with GS7 linked to trading stolen credentials and access in underground markets and using **Telegram bots** for credential handling/exfiltration; reporting also notes abuse of legitimate remote management tooling to help establish persistence after credential capture. Dark Reading’s coverage of the SOCRadar findings emphasized the campaign’s effectiveness stemming from near-perfect portal impersonation and rapid infrastructure rotation, increasing the likelihood of successful credential theft against both enterprises and their customers. For defenders, the reporting highlights the need to treat this as an ongoing, scalable credential-harvesting and initial-access operation: prioritize monitoring for lookalike domains and brand-abuse infrastructure, strengthen anti-phishing controls around customer/employee authentication flows, and review remote management tool governance to reduce the impact of stolen credentials being converted into durable access.
Jun 29, 2026
Suspected former **Black Basta** affiliates have launched a fast-scaling social-engineering campaign against dozens of organizations, targeting more than 100 employees to gain network access for **data theft, ransomware deployment, and extortion**. According to ReliaQuest, the operators use mass email bombing to overwhelm victims and then follow up through **Microsoft Teams** messages or phone calls while impersonating IT help desk staff. The activity has been linked to former Black Basta members or closely aligned actors because the tooling, targeting, and execution closely mirror the group’s historical playbook, even after Black Basta fragmented following the leak of its internal chats. The campaign has increasingly focused on senior leaders and other highly privileged personnel, with executive targeting rising from **59%** in January and February to **77%** in March. Attackers have persuaded victims to install remote monitoring and management tools such as **Supremo Remote Desktop** or to launch **Windows Quick Assist**, sometimes obtaining remote access within minutes before running malicious scripts. Manufacturing and professional services have been hit hardest, with finance, insurance, construction, and technology also affected, underscoring how the operators are moving faster and using more automation to scale intrusions and make early detection more difficult.
Jun 29, 2026