Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry

TL;DR: OPERATION TALKED is an ongoing Russia-linked espionage campaign, exposed after the actor left their own C2 as an open directory of 8,436 files. Over 14 months, it ran mass exploitation of 1.1M+ internet-facing targets alongside a focused effort that breached nine Ukrainian defense and aerospace contractors and stole their Git repositories. It was still live at publication, with an open shell on a Ukrainian railway logistics operator. SOCRadar attributes it to a Russia-nexus actor with high confidence.

What Is Operation Talked?

SOCRadar Researchers uncovered an active, ongoing Russia-linked cyber espionage operation, which we track as OPERATION TALKED, after finding that the actor’s own command-and-control (C2) server had been left as a fully open, unauthenticated directory. On port 8090, a plain Python SimpleHTTP listener exposed more than 8,400 operational files: attack tools, stolen credentials, target lists, and full session logs.

That single misconfiguration turned the actor’s infrastructure into a 14-month case file. What it revealed is a dual-track campaign that runs mass, opportunistic exploitation of internet-facing appliances in parallel with a focused espionage effort against Ukraine’s defense and aerospace sector. SOCRadar attributes this activity to a Russia-nexus actor with high confidence, based on TTP overlap with UAC-0056 / UAC-0114, Moscow-timezone activity, and Russian-language artifacts the actor left in their own shell history.

The campaign is not concluded. As of the most recent monitoring (July 26, 2026), an interactive shell remained open on a compromised Ukrainian railway logistics operator, and the actor’s Sliver C2, WireGuard VPN, and 3x-ui panel were still live and responding.

Key Takeaways

• OPERATION TALKED is an ongoing Russia-nexus espionage campaign active for 14 months (June 2025 to July 2026), attributed with high confidence based on TTP overlap with UAC-0056 / UAC-0114.
• The operation was exposed by the actor’s own OPSEC failure: an unauthenticated open directory on the primary C2 that leaked 8,436 operational files.
• The actor breached nine Ukrainian defense, aerospace, and aviation contractors, stealing full Git repository dumps, and held an active interactive shell on a Ukrainian railway logistics operator at the time of publication.
• Alongside targeted espionage, the actor ran mass exploitation across more than 1.1 million unique internet-facing targets, weaponizing 19 CVEs plus SonicWall SSL-VPN and RabbitMQ.
• Core infrastructure runs on a bare Yandex Cloud IP hosted in Moscow (AS13238), with a professional Sliver C2 framework using mTLS and HTTP listeners.

An Open Directory Exposed a Live Operation

The entire investigation traces back to one exposed server. The actor’s primary C2 sits on Yandex Cloud in Moscow (AS13238) with no CDN, WAF, or reverse proxy in front of it. Every service is reachable on the bare IP address, and one of those services was an open directory serving 8,436 files with no authentication.

Because the actor stored tools, shell history, target lists, stolen credentials, and Sliver session logs on that same server, we were able to reconstruct the operation from the attacker’s own perspective rather than inferring activity from victim-side telemetry alone. Every kill-chain stage described below maps to a technique observed directly in the actor’s logs, shell history, or C2 configuration.

One caveat worth stating plainly: this level of visibility exists because of an operational mistake, and it should not be assumed to represent the actor’s normal discipline going forward.

Inside the C2 Infrastructure

The primary C2 exposes its full service stack on the bare Moscow IP:

A set of secondary and supporting hosts rounds out the infrastructure, including an Oracle Cloud staging server in Austin, Texas (129.146.87.174, since cleaned), a secondary node in Slovenia branded internally as “Global Outreach Engine / EMPIRE ENGINE” (130.12.182.216, taken down, July 23, 2026), and several webshell and tunnel relays running Godzilla ASPX, suo5, r57, reGeorg, and Neo-reGeorg.

The full WireGuard client private key, server public key, and preshared key were all recovered in plaintext from the actor’s own configuration file. The single most important defensive takeaway from the infrastructure is that exposing every service, credential, and log on one unprotected IP is what made the whole operation harvestable once the open directory was found.

Full tool inventory grouped by function (C2 and tunneling, credential theft and lateral movement, reconnaissance and data theft, and supporting utilities), recovered from the exposed operations server.

The Operator Behind “Talked”

The operator’s activity ties together a set of accounts and handles recovered from the exposed server. Some are the actor’s own operational artifacts; others are credentials the actor used but did not necessarily own, a distinction covered under Attribution below.

The strongest attribution signals come from the actor’s own keyboard. The system was set to a JCUKEN (Russian) layout, and the operator repeatedly typed Latin shell commands while Cyrillic input was active, leaving stray Cyrillic strings in the shell history (тут, св, ды, иуыуыр). The logs also contain Russian-language script output (“Готово! Данные сохранены”) and a Russian code comment (“ваш запрос”). Combined with the Moscow-hosted infrastructure, UTC+3 activity, and TTP overlap with UAC-0056 / UAC-0114, these traces support the 85% Russia-nexus attribution.

Attribution

SOCRadar attributes OPERATION TALKED to a Russia-nexus actor with 85% confidence, based on six independent technical indicators recovered from the actor’s own C2:

1. Cyrillic keyboard traces: The .bash_history contains commands mistyped in the Russian JCUKEN layout (cd typed as св, ls as ды, a Cyrillic с breaking a Python command), muscle-memory slips a VPN cannot mask.
2. Russian-language source code: Recovered tools are written in Russian throughout, including a 140-line utility and a live FortiGate scanner that prints Готово! Данные сохранены, pointing to a native speaker rather than machine translation.
3. Netlas API: The actor held a working key for Netlas, the St. Petersburg-based Shodan alternative that requires a Russian phone number and bank card, and used it across three scripts to enumerate FortiGate appliances by country.
4. Yandex Cloud Moscow: The primary C2 (46.8.236.121, AS13238) runs in Moscow on infrastructure gated by the same Russian KYC requirements.
5. Hands-on targeting of Ukraine: Sliver console recordings show the operator working interactively on a compromised Ukrainian railway logistics operator, enumerating and dumping databases on a server set to the Europe/Kiev timezone, consistent with espionage rather than financial crime.
6. A tooling profile that fits: Sliver mTLS + HTTP C2, the 3x-ui/Xray panel, WireGuard, the Russian-built Gost SOCKS5 tunneler, and a modern Windows toolchain, all tied to the root@talked SSH key that named the operation.

The actor also relied on actor-utilized accounts, most notably a hijacked developer credential used to reset a password and log into a victim’s admin panel. Because these belong to third parties rather than the actor, we exclude them from the published IOC set, and they play no part in the attribution above.

From Mass Scanning to Targeted Espionage

OPERATION TALKED runs on two tracks at once. One is broad and opportunistic: internet-wide scanning and pre-authentication remote code execution against internet-facing appliances. The other is deliberate: hands-on-keyboard intrusion into Ukrainian defense and aerospace targets, ending in bulk theft of source code from Git repositories.

The reconstructed kill chain maps to techniques observed directly in the actor’s tooling:

The initial-access track relies on pre-authentication RCE against six internet-facing appliance families. Once inside, the actor pivots to a professional Sliver C2 framework with both mTLS and HTTP listeners, then moves laterally with stolen NTLM hashes and Kerberos tickets. Data leaves the network through a layered proxy and tunneling stack (Neo-reGeorg, Chisel, suo5, Gost SOCKS5) and out to cloud storage or FTP.

Victimology: Ukraine’s Defense Sector, and an Active Breach

The espionage track is tightly focused. SOCRadar observed breaches at nine Ukrainian defense, aerospace, and aviation organizations, in each case involving theft of Git repositories. Organization names and domains are withheld pending coordinated disclosure and remediation; sector and impact are disclosed to illustrate scope.

At the time of publication, the actor held an interactive shell on a Debian 11 server belonging to a Ukrainian railway logistics operator, having compromised four Laravel applications that shared a common database password.

Recovered SMTP relay credentials would allow phishing pivots from the victim’s own mail infrastructure. Domains, database credentials, and admin contacts are withheld; the affected organization has been notified, and remediation is in progress.

Beyond Git theft, the actor reached domain-admin or full-network control in several environments through stolen backup keys, mimikatz paired with a Godzilla webshell, FortiGate VPN compromise, and Pass-the-Hash combined with DPAPI cookie theft.

Nine sectors observed across confirmed victims and mass-exploitation telemetry, led by Defense, Aerospace, and Aviation.

Ukraine is the primary target across the defense and logistics sector. Secondary geographies observed include Russia, Romania, Poland, Moldova, Latvia, Switzerland, Ireland, and South Korea, on top of a broad opportunistic global scanning footprint.

Mass Exploitation and the CVE Arsenal

Running in parallel with the targeted intrusions, the actor scanned or exploited more than 1.1 million unique internet-facing targets. A single vulnerability dominated the volume: Sophos XG (CVE-2022-1040) alone accounts for roughly 757,000 targets.

The arsenal spans 19 CVEs with disclosed identifiers, plus SonicWall SSL-VPN and RabbitMQ exploitation observed without a disclosed CVE. Several carry custom tooling recovered from the C2.

14-Month Operational Timeline

The timeline below was reconstructed entirely from file modification timestamps, shell history, and Sliver session logs recovered from the actor’s own C2. It runs from FortiGate VPN reconnaissance in June 2025 through the critical escalation window of July 24 to 26, 2026.

Operation Talked Timeline

Timeline above: 26 reconstructed events from June 2025 to July 2026, with coral markers denoting the July 24-26, 2026 escalation window: an interactive shell opened on the railway logistics victim (July 24), data exfiltration from the C2 detected by SOCRadar (July 25), and live monitoring confirming the C2, mTLS listener, 3x-ui panel, and WireGuard all active (July 26).

Remediation

• Patch every internet-facing appliance matching the 19+ CVEs in this campaign’s arsenal, prioritizing Sophos XG (CVE-2022-1040), WordPress (CVE-2026-63030), FortiOS (CVE-2024-55591), F5 BIG-IP (CVE-2023-46747), SAP NetWeaver (CVE-2025-31324), and Roundcube (CVE-2025-49113 / CVE-2025-25257).
• Block all listed C2, webshell/tunnel, and exfiltration IOC IPs at the firewall and IPS, prioritizing 46.8.236.121 and its associated ports.
• Force-rotate all FortiGate SSL-VPN, domain admin, and service-account credentials across any environment with FortiGate exposure, given the credential-reuse risk.
• If Pass-the-Hash / Pass-the-Ticket or domain-admin compromise is suspected, rotate the KRBTGT account twice per Microsoft guidance.
• Hunt for and remove Godzilla, r57, suo5, and Neo-reGeorg webshells on IIS / ASP.NET and PHP-hosted applications.
• Audit Git repository access and clone logs for git-dumper-style bulk-download activity, and rotate any credentials or keys committed to exposed repositories.
• Hunt for Sliver implant indicators, including process masquerading and beacon traffic to 46.8.236.121:11008 / 11009 at 60-second mTLS check-in intervals.
• Restrict or disable WinRM and SMB administrative shares where not operationally required, and segment networks to break Pass-the-Hash and WinRM lateral-movement paths.
• Review DPAPI-protected credential stores on any host where compromise is suspected (DonPAPI target).
• For any organization identified through the exposed Elasticsearch instance, initiate coordinated third-party disclosure.

In Conclusion

OPERATION TALKED is an ongoing Russia-nexus cyber attack campaign distinguished by its dual-track structure: mass opportunistic exploitation of internet-facing appliances running in parallel with a targeted, 14-month espionage effort against Ukraine’s defense and aerospace industry. The actor’s own operational failure, an unauthenticated open directory on its primary C2 server, is what made this level of visibility possible, and it should not be assumed to represent the actor’s normal operating discipline going forward.

As of publication, the campaign is not closed. An interactive shell remains open on a compromised Ukrainian railway logistics operator, and the actor’s Sliver C2, WireGuard VPN, and 3x-ui panel remain live and responsive. Organizations in the defense, aerospace, aviation, government, and logistics sectors, particularly those with any FortiGate, Sophos XG, WordPress, F5 BIG-IP, SAP NetWeaver, or Roundcube exposure, should treat the associated CVEs as actively weaponized and prioritize patching accordingly.

This threat can be tracked and monitored through SOCRadar Platform and campaigns, which help identify exposed appliances matching this campaign’s exploited CVEs, track Sliver C2 and webshell infrastructure associated with OPERATION TALKED, and surface new victim indicators as coordinated disclosure and remediation proceed.

Indicators of Compromise

Network indicators

Identity indicators

File hashes