Fiora Night (REZ) Credential Harvesting & Phishing Operation

Ghost Mailer ProTelegram C2Fiora NightPhishingCredential Harvesting

Fiora Night (REZ) is a financially motivated,Go-based distributed scanning botnet that crawls the web for exposed secrets (.env files, Git configs, S3 URLs, JVM heap dumps)and verifies them live via provider APIs.High-value hits stream to a private Telegram C2 channel and feed an unauthenticated phishing console,"Ghost Mailer Pro," currently targeting GMX users.A single 62-minute scan of 35,072 domains yielded 3,333 verified credentials and 153,911 IOC lines across 5,387 victim domains in 75+ countries including live AWS, Stripe, GitHub, Anthropic, and OpenAI keys plus confirmed Log4Shell RCE on 395 hosts. Assessed as a novel, francophoneorigin actor.

Indicators of Compromise

Hashes (9)

1bc81f983b8095b2283c11c69da4ed0d4c14355f6d8c22f372b14e803977098fc60c13d160b7cdfee07e22081fb0671a542a041ecdc068c535062f0573389780cbcfdc383a8042e2dd7b10d7ffcfff8c655a37a03daea6cd06659f1c4efe0edfccef4cdee1a9ffd9019f5c9e6ae91a047c9a779e4b039c2039c70d420bcfb48ec327dc3248bdb17ea5668ee2bc4ce888adc2e7652f53b6fdd9d85051b27d67f3fadc1ffc8e8391c73922bd7ed5d99ae3f884f8dce2b3b2f893b427b91c28f28f86dba459ad0e7b25a0ffff688e9bf7b06e2d105e34f967c0a9660e083a3475926c5d2380d1e39c82219ea35818c4e38696864988b8ea68f8cc4368f2ef1bfbba5d13e579ab76afabc8cd514c05f99a764c3e53c4087b4573dd6cd9f0a3e96b73

IPv4 (1)

195.178.110.223

APT Groups

Fiora Night

Notes

Conclusion Fiora Night (REZ) demonstrates how a single operator, working with off-the-shelf cloud APIs and a self-built Go toolchain, can compound credential theft into a self-funding, self-propagating botnet and a live phishing operation — all surfaced through one operational-security mistake: an unauthenticated open directory exposing the actor’s own C2 token. The combination of confirmed live AI, payment, and code-hosting credentials, a five-year-old RCE still working at scale, and a currently active phishing campaign with real victim clicks makes this a high-priority, time-sensitive notification case rather than a purely historical finding.SOCRadar customers can track this campaign across the <a href="https://">SOCRadar</a> platform using IOC Radar (hash, domain, and IP hunting against 195.178.110.223 and associated indicators), Cyber Threat Intelligence (CTI) module (ongoing campaign and victim-domain tracking), Attack Surface Management (ASM) (exposure checks for .env/.git/backup files and unauthenticated Redis/Elasticsearch/ChromaDB instances), and Dark Web Monitoring (tracking the “REZ Smtp Only” channel and any successor C2 channels).<div> </div>

Mitigation

Mitigation The following mitigations apply to any organization with internet-exposed applications, cloud infrastructure, or accounts that may intersect with Fiora Night (REZ)’s opportunistic scanning, or that has identified itself among the victim indicators in this report. Controls are ordered by implementation priority.<div> </div><div>Immediate Actions </div><div><ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Rotate every credential type catalogued in this report (.env-sourced AWS/GCP keys, GitHub/GitLab tokens, SMTP, Stripe, SendGrid, Resend, Mailjet, Twilio, OpenAI, and Anthropic keys) that has ever been committed to a public or semi-public location.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Treat password rotation alone as insufficient for any secret that also appears in Git commit history — full history rewriting (BFG Repo-Cleaner or git filter-branch) is required, since the historical value remains both in version control and in the actor’s own dump.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Block 195.178.110.223 at the network perimeter and across all security tooling (EDR, proxy, firewall, secure email gateway).</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Audit any externally reachable Redis (6379) or Elasticsearch (9200) instance and enable authentication immediately — both are scanned unauthenticated by the actor’s advanced_probes.go module.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Check outbound connection logs for traffic to 195.178.110.223 from any host running ChromaDB, Ghost CMS, or a Java application with bundled Log4j — the actor’s four confirmed exploitation targets.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">If your organization uses GMX, Mailjet, Twilio, SendGrid, Resend, or Stripe, check whether any account matches the active phishing-sender or victim accounts listed in the Indicators of Compromise summary.</li></ul><div> </div><div>Short-Term Controls</div><div> </div><div><ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Remove secrets from .env, config.bak, settings.py.bak, and similar files in web-server document roots; block direct access to /.env, /.env.*, /.git/, /backup.*, and /config.bak at the web server or WAF layer.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Migrate secrets to a managed secrets store (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager) rather than flat configuration files.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Patch or network-isolate any internet-facing application with a bundled Log4j dependency; this actor confirmed live remote code execution on hosts unpatched five years after CVE-2021-44228 disclosure.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Restrict ChromaDB and other vector-database deployments to internal networks only; never expose the default port (8000) externally without authentication.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Enable cloud audit-log alerting for API or secret usage originating from source IPs outside known CI/CD or office ranges, to catch reuse of stolen long-term IAM keys.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Review DNS zone-transfer (AXFR) configuration to ensure transfers are restricted to authorized secondary nameservers only.</li><li style="list-style-type: disc; font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Brief end users on the active “Your invitation is ready” phishing lure (sender persona “Jupiter”) currently targeting GMX, GMX.de, and related webmail accounts in Germany, Austria, Switzerland, and the UK.</li></ul></div></div>