Open Directory Exposes Government Credentials and Possible Phishing Targets
Summary
Hunt researchers found an exposed server containing pentesting tools, test results, credentials attributed to Egyptian government entities, and email lists or spoofing domains related to government organizations in five other countries. The server’s origin and intent is
Key points
- The server hosted 15,923 files and a broad collection of offensive security tools, including Sliver, Evilginx, Impacket, and Mimikatz.
- Files in a folder labeled as an external penetration test contained network and host scan results associated with Azerbaijan’s state-owned oil and gas company.
- Separate files included .ntds and .sam data, BloodHound output, and username-password lists attributed to Egyptian government entities, suggesting domain-controller access.
- The directory also held email lists or related files for government organizations in Canada, Moldova, Nepal, Nigeria, and Ukraine.
- Researchers identified lookalike domains spoofing Nepalese government organizations and assessed they could be used for phishing.
- The researchers could not determine whether the server belonged to authorized testers, a threat actor, or another party holding stolen material.
Article Details
- Attack Vectors
- A server exposed an open directory containing credentials and email-address lists associated with government organizations; the article says the lists and lookalike domains may be used for phishing.
- Files in the SOCAR_RESULTS/EXCH folder indicated an attempt to brute-force the exchange server for socar.az.
- Files associated with Egypt’s Mechanical and Electrical Department and Ministry of Military Production included credentials and domain-controller-related files, suggesting unauthorized access, though the origin and authorization remain unknown.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 91[.]132[.]95[.]28 | Suspicious server hosting the exposed directory and files associated with possible targeting of government organizations. |
MITRE ATT&CK
Tools
Countries
Azerbaijanonshore and offshore oil and gas company, also known as the State Oil Company of the Republic of Azerbaijan.CanadaFurther investigation revealed a far more troubling find – a cache of credentials and email address lists likely for phishing belonging to government organizations in Egypt, Moldova, Nepal, Nigeria, Canada, and Ukraine.EgyptFurther investigation revealed a far more troubling find – a cache of credentials and email address lists likely for phishing belonging to government organizations in Egypt, Moldova, Nepal, Nigeria, Canada, and Ukraine.MoldovaFurther investigation revealed a far more troubling find – a cache of credentials and email address lists likely for phishing belonging to government organizations in Egypt, Moldova, Nepal, Nigeria, Canada, and Ukraine.NepalFurther investigation revealed a far more troubling find – a cache of credentials and email address lists likely for phishing belonging to government organizations in Egypt, Moldova, Nepal, Nigeria, Canada, and Ukraine.NigeriaFurther investigation revealed a far more troubling find – a cache of credentials and email address lists likely for phishing belonging to government organizations in Egypt, Moldova, Nepal, Nigeria, Canada, and Ukraine.UkraineFurther investigation revealed a far more troubling find – a cache of credentials and email address lists likely for phishing belonging to government organizations in Egypt, Moldova, Nepal, Nigeria, Canada, and Ukraine.
Industries
GovernmentFurther investigation revealed a far more troubling find – a cache of credentials and email address lists likely for phishing belonging to government organizations in Egypt, Moldova, Nepal, Nigeria, Canada, and Ukraine.Meat and poultryour attention, prompting us to investigate the server's contents furthersocar[.]com is a European meat and poultry exporter. This first folder contains the usernames and email addresses of those at a TurkishOil and gasIP addresses, usernames, etc.). socar[.]az is the domain name for the state-owned onshore and offshore oil and gas company, also known as the State Oil Company of the Republic of Azerbaijan.