Exposed Directory Reveals Russian-Speaking Broker’s Intrusions and Ukraine-Focused Collection

Aug 3, 2026 · Original article ↗

Summary

CloudSEK says an exposed server documented a Russian-speaking access broker exploiting internet-facing systems, stealing credentials and compromising domains. The investigation also found collection targeting Ukrainian defence and aerospace organizations, alongside ties

Key points

The exposed directory recorded activity from mid-2025 into late 2026, including campaigns against internet-facing appliances and applications across more than a dozen countries.
The operator used public and modified exploits against products including Fortinet, F5, Citrix, SonicWall and SAP, then harvested credentials and accessed internal Windows systems.
CloudSEK reports full Active Directory compromise at multiple organizations, as well as theft or enumeration of device configurations, credentials, private keys and cloud backup repositories.
Several compromised organizations were later claimed by different ransomware groups, weeks after the broker's recorded access; the article assesses that the operator supplied access rather than carrying out the extortion.
Later activity included Sliver C2, exposed Git repository theft and collection from Ukrainian defence and aerospace targets, plus imagery from internet-facing cameras and remote desktop sessions.
CloudSEK assesses with high confidence that the operator is Russian-speaking and with moderate-to-high confidence that the Ukraine-focused collection served state intelligence requirements, while leaving the nature of any state tasking unresolved.
The article recommends patching and removing management interfaces from direct internet exposure, rotating potentially exposed credentials, investigating suspected domain compromise, and isolating and securing IP cameras.

Article Details

Attack Vectors: Exploitation of internet-facing appliances and applications using public proof-of-concept exploits and modified exploit code for the listed CVEs.
Credential harvesting and creation of administrative accounts on exposed F5 BIG-IP load balancers.
Access through a Neo-reGeorg web shell and SOCKS tunnelling, followed by authentication to internal Windows hosts using stolen NTLM hashes.
Active Directory compromise involving extraction of the DPAPI backup key, recovery of stored credentials, dumping of SAM and LSA secrets, and use of a forged Kerberos golden ticket.
Access to cloud backup repositories using stolen credentials and theft of firewall configurations containing credentials, certificates, and private keys.
Deployment of Sliver C2 for collection against Ukrainian defence and aerospace organisations, including theft of exposed Git repositories.
Collection of imagery from exposed IP cameras and screenshots from exposed remote desktop services.
Defensive Notes: Remove appliance management interfaces from direct internet exposure, patch the listed vulnerabilities, and audit development, staging, and disaster-recovery devices to production standards.
Rotate appliance administrative credentials and credentials stored in device configurations; treat exfiltrated configurations as disclosure of the network behind the device.
Where domain compromise is suspected, reset the krbtgt password twice with a full replication interval between resets, disable RC4-HMAC in favour of AES, and alert on Kerberos tickets whose lifetimes exceed domain policy.
Disable LLMNR and NBT-NS, enable SMB signing and Extended Protection for Authentication, restrict WinRM to designated administrative hosts, and deploy a vulnerable-driver blocklist.
Change default IP-camera credentials, keep firmware current, isolate cameras on a VLAN without direct internet exposure, and restrict camera fields of view.
Investigate unfamiliar successful administrative logins for backdoor accounts, injected SSH keys, or altered configuration, and alert on appliance-originated connections to internal hosts.

Indicators of compromise

Type	Indicator	Context
IPV4	`107[.]189[.]16[.]231`	Chisel reverse SOCKS endpoint; the source lists port 7072.
IPV4	`129[.]146[.]87[.]174`	Operator jumpbox endpoint; the source lists port 18080.
IPV4	`185[.]217[.]98[.]121`	File transfer service identified in the operator infrastructure.
IPV4	`46[.]8[.]236[.]121`	Operator VPS identified as part of the operator's infrastructure.
SHA256	`16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0`	Hash of a vulnerable signed driver bundled with a credential dumper.
SHA256	`b2d46bfc25df83dd39b7e15e9ef5c182cd20ee4d862ac612593ac46257d13be8`	Hash of the Sliver Linux implant identified in the article.