Exposed WebDAV lab: 1,048 artifacts, real Mexico victims
Rapid7 found an exposed WebDAV server with 1,048 attacker artifacts — QA'd lures, three tested CVEs, and 2,384 confirmed launch hits against Mexican targets.
airgap Rapid7 published analysis of an exposed WebDAV server the operator left open on onedrive[.]cv. Confirmed: 1,048 artifacts on disk, five and a half days of panel logs, and 2,384 phishing-page launches concentrated in Mexico. Real users, real hits.
Discovery was accidental. An MDR alert flagged rundll32.exe pulling from a WebDAV path; WebClient telemetry pointed at the host; the directory was listable. Everything downstream is what happens when the attacker forgets to lock down their own build environment.
What was on the server
Confirmed by Rapid7 file counts: 453 shortcut launchers, 236 filename-spoofing QA files, 146 URL/LOLBin execution tests, 89 encrypted droppers, 17 WebDAV init scripts. Panel logs recorded 77,098 requests from 3,892 unique IPs across 101 countries between June 20 and June 26, 2026 — roughly 45.9 GB moved. Mexico: 82.5% of that traffic.
Two named campaigns ran off the same box.
CURP campaign. Payload: an unfamiliar .NET information stealer, version 4.4.3, build tag 06x12x2026SantaEbash2. Targets cryptocurrency wallets, browser credentials, Telegram tdata, Foxmail. Exfil to 77.110.127.205 over TLS on ports 56001–56003, 57666, 57777, and 57888. The phishing site — gobf[.]mx, impersonating Mexico’s official CURP identity lookup — logged 2,384 launch events. Peak traffic in Mexican working hours, 16:00–19:00 UTC. Treat that as confirmed victim interaction, not noise.
DlrtyGames campaign. Rapid7 identifies the payload as PureRAT, deployed via DLL sideloading. Keylog, screenshots, process hollowing into signed binaries. C2 to 23.94.252.228:57666.
CVEs the operator was rehearsing against
Rapid7 observed the lab systematically QA’ing three, all already-patched:
- CVE-2025-33053 — working-directory hijacking via
iediagcmd.exe. CVSS 8.8. - CVE-2026-21513 — CVSS 8.8.
- CVE-2025-24054 — CVSS 6.5.
Lure files leaned on right-to-left override, double extensions, and Unicode spoofing. Delivery mixed search-ms: URIs, .library-ms files, and signed-binary abuse. No exploitation walk-throughs here — the Rapid7 writeup carries the mechanics.
The AI angle — flag confidence
Rapid7 notes README files on the server “appeared LLM-generated based on structure and phrasing,” and a hardcoded build path pointed at the CodeRRR project with LLM assistance. Unconfirmed provenance — the reporting hedges, so does this piece. What is confirmed: the operator built and QA’d the delivery pipeline the way a product team would. Dozens of variants, systematic execution tests, staged lures.
No threat actor named. No cluster attribution.
IOCs and defensive priorities
Pulled from the Rapid7 post — verify against your own telemetry, don’t blocklist blindly:
- WebDAV staging:
onedrive[.]cv - CURP phishing:
gobf[.]mx - CURP C2:
google.services[.]ug,77.110.127.205 - DlrtyGames C2:
23.94.252.228 - Sample hash:
ReportFinal.rcs.pdfSHA-25604A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7
Detection priorities Rapid7 calls out: monitor WebDAV activity from user endpoints, watch for working-directory hijacking patterns, block RTLO and extension spoofing at the mail gateway. Full IOC list is behind Rapid7’s Intelligence Hub for their customers.
Patch the three CVEs above if you haven’t. The lab was rehearsing against them, not chasing zero-days — that’s a lower bar than “0day”, and it still works.
Found this useful? Share it.
