A Russian-speaking hacker has orchestrated a widespread campaign targeting organizations across various sectors, including education, healthcare, financial services, telecommunications, and government agencies. The attacker exploited known vulnerabilities in internet-facing systems to gain unauthorized access, subsequently harvesting credentials and selling this access to ransomware groups.
The hacker’s modus operandi involved scanning for exposed security appliances and public applications, leveraging publicly available proof-of-concept exploits for at least 12 vulnerabilities affecting products from companies such as Fortinet, F5, SonicWall, Sophos, Citrix, SAP, Roundcube, vBulletin, and Hikvision. Once inside a network, the attacker employed web shells and network tunnels to infiltrate Windows systems, extracting NTLM password hashes and other sensitive credentials to escalate privileges and achieve full control over company identity systems.
CloudSEK researchers uncovered this activity after discovering an exposed server containing detailed records of the hacker’s operations. The evidence suggests that the individual functions as an initial access broker, facilitating entry points for ransomware groups rather than deploying ransomware directly. This underscores the critical role initial access brokers play in the cybercriminal ecosystem, providing a streamlined pathway for ransomware actors to infiltrate victim networks without identifying vulnerabilities themselves.
In a notable shift, the hacker redirected efforts towards Ukrainian defense and aerospace organizations. Utilizing Sliver command-and-control tools, the attacker accessed exposed source-code repositories and collected information beyond typical corporate access sales. Investigators also found hundreds of images from internet-facing IP cameras and screenshots from exposed remote desktop sessions, potentially offering insights into facilities, staff movements, and logistics within Ukrainian critical sectors.
This activity aligns with previous warnings about Russian-linked actors targeting cameras near border crossings, military locations, and transport infrastructure to monitor aid movements into Ukraine. Such surveillance operations highlight the multifaceted nature of cyber threats, where initial access can serve both financial and strategic espionage objectives.
The findings emphasize the importance of securing internet-facing devices and promptly addressing known vulnerabilities. Organizations must adopt a proactive cybersecurity posture, including regular vulnerability assessments, timely patch management, and robust monitoring of network activities to detect and mitigate unauthorized access attempts.
