Skip to content

Exposed WebDAV malware delivery lab and CURP campaign

Summary

Rapid7 disclosed an exposed attacker server on July 20, 2026 that contained 1,048 artifacts spanning lure generation, filename-spoofing tests, WebDAV delivery, shortcut and LOLBin experiments, encrypted droppers, ClickFix pages, and operator documentation. The workspace connected development and quality-assurance activity to an active campaign impersonating Mexico's CURP national-identity lookup service.

The operation is durable defender intelligence because it shows a Russian-speaking operator using an LLM-assisted workflow to industrialize phishing delivery rather than merely generate a single payload. The actor built matrices of test cases, documented failures and priorities, tested patched and candidate execution paths, and ran delivery through an exposed Simba Service WebDAV panel.

Tags

Why this matters

  • The exposed workspace showed an end-to-end delivery pipeline: lure creation, rendering tests, execution experiments, payload packaging, campaign administration, and live request telemetry.
  • The actor's 59-file .url test kit sought signed Windows binaries that might reproduce CVE-2025-33053-style working-directory hijacking on systems where the original iediagcmd.exe route is patched or unavailable.
  • Most candidate binaries in the test matrix were hypotheses, not confirmed vulnerable execution paths. Defenders should not treat the operator's README claims as validated vulnerability findings.
  • LLM assistance appears to have increased the speed and structure of experimentation. Rapid7 did not claim that an AI model autonomously created the malware.

Exposed delivery workspace

Rapid7 grouped the recovered files into the following operational functions:

Category Count Defender relevance
LNK delivery launchers 453 Bulk document-themed shortcuts, fake icons, spoofed filenames, and multiple launch paths.
Filename-spoofing QA 236 RTLO, Unicode, double-extension, whitespace-padding, and Explorer/browser rendering tests.
URL / LOLBin tests 146 Signed-binary and remote-working-directory experiments over WebDAV.
Encrypted droppers 89 Packaged second-stage payloads.
Alternative execution containers 24 search-ms, library-ms, and Control Panel delivery paths.
Payload stubs / spoofed executables 21 Decoys, renamed binaries, and loaders.
WebDAV scripts 17 Delivery-reliability tooling for Windows clients.
Builder / operator notes 10 Test plans, mappings, reports, and generation scripts.
ClickFix pages 9 Cloudflare, Adobe, Microsoft, Chrome, Discord, and document-error lures.

Russian comments and folder names such as testik support a Russian-speaking context but do not identify an actor. Rapid7 linked the structured, verbose, emoji-heavy documentation and a hard-coded local path to likely use of the public CodeRRR/Coderrr coding-agent project. That assessment should remain a workflow observation, not actor attribution.

Working-directory hijack experimentation

The most developed test family attempted to reproduce or adapt CVE-2025-33053, a Windows .url working-directory hijack documented in the 2025 Stealth Falcon campaign. A shortcut launches a legitimate signed binary while setting its working directory to an attacker-controlled WebDAV share; if that binary starts a child by bare filename, Windows may resolve the attacker's remote executable before the expected local binary.

The recovered notes preserved the previously reported iediagcmd.exe / route.exe example and acknowledged that the June 2025 patch blocks the original route. The actor therefore generated 59 candidate .url tests covering .NET utilities, system tools, LOLBAS entries, and UAC-bypass candidates. The server also held smaller test sets for:

  • CVE-2026-21513: MSHTML security-feature bypass;
  • CVE-2025-24054: crafted path handling that can trigger outbound NTLM authentication;
  • alternate WebDAV/UNC, search-ms, library-ms, .cpl, PowerShell, bitsadmin, certutil, mshta, and rundll32 delivery paths.

Active CURP campaign

The active chain began at gobf[.]mx, a typosquat of Mexico's official CURP lookup service. The fake page collected CURP data and invoked a search-ms: URI that opened an attacker-controlled WebDAV path at onedrive[.]cv in Windows Explorer, filtered for .scr files.

The dominant lure appeared to be a PDF but used a right-to-left override to disguise an .scr executable. An Inno Setup package launched a loader that decrypted a .NET stealer, reflectively loaded it, and hollowed it into a signed Qihoo 360 process. Rapid7 reported collection of browser credentials and session cookies, Telegram session data, screenshots, and cryptocurrency wallet clients and extensions.

Between June 20 and June 26, the panel logged 77,098 requests from 3,892 unique client IPs across 101 countries. Mexico generated 82.5% of requests and 96.9% of 2,441 executable launch events; the CURP lure accounted for 2,384 launch events. Rapid7 explicitly cautioned that a launch event is a file request consistent with an attempted run, not confirmation of endpoint execution or infection.

DlrtyGames chain

A second campaign folder, DlrtyGames, used a 7-Zip SFX package to place a signed Ubisoft binary beside a malicious discord-rpc.x64.dll. DLL sideloading led to an image-carried encrypted payload, delayed execution, COM auto-elevation, process hollowing, and a modular .NET RAT.

Rapid7 identified the final RAT in the analyzed chain as PureRAT, with plugins for keylogging, screenshots, window monitoring, browser data, and wallet-extension collection. The two analyzed chains used different C2 infrastructure, so defenders should correlate behavior as well as static indicators.

Detection and response guidance

  • Hunt for the WebClient service starting shortly before davclnt.dll communicates with an external host, especially when followed by executable retrieval.
  • Alert when a signed Windows binary spawns a child whose image path resolves to a WebDAV or UNC location. Include .url files with remote WorkingDirectory values in triage.
  • Monitor PROPFIND and GET traffic to unusual external WebDAV servers, search-ms: and library-ms launches, and paths containing DavWWWRoot or @ssl@443.
  • Detect filenames containing RTLO (U+202E), double extensions, homoglyphs, or large whitespace padding before .exe or .scr.
  • Hunt for browser-initiated or document-lure execution of rundll32, mshta, PowerShell, bitsadmin, or certutil, followed by WebDAV/UNC access.
  • Patch CVE-2025-33053 and the other referenced Windows flaws. Do not assume patching the original iediagcmd.exe path addresses every candidate signed-binary search-order behavior.
  • If execution is confirmed, isolate and preserve the host before cleanup. Collect shortcut/container files, WebDAV URLs, process trees, memory, browser and Telegram session artifacts, wallet data, persistence, and network telemetry; then rotate credentials and revoke sessions reachable from the endpoint.

Selected indicators

Type Indicator Context
Domain gobf[.]mx CURP phishing page.
Domain onedrive[.]cv CURP WebDAV delivery host.
SHA-256 04a8018191f2e9e76072d072a933371d9d669a42de2b2a087541cd3a653b0ba7 RTLO-disguised CURP executable reported by Rapid7.
IP / port 77[.]110[.]127[.]205:56003 CURP-chain stealer C2 reported by Rapid7.
IP / port 23[.]94[.]252[.]228:57666 DlrtyGames-chain C2 reported by Rapid7.

Use Rapid7's maintained IOC repository for the complete indicator set and verify current infrastructure status before blocking shared services.

Sources