Inside FIORA NIGHT: Anatomy of a Credential Harvesting Operation

Key Highlights:

• Complete analysis of the FIORA NIGHT (“REZ”) infrastructure, tooling, and operator profile
• Breakdown of the botnet’s credential harvesting pipeline, phishing operations, and nine-phase attack chain
• Analysis of active exploitation targeting vulnerabilities including Log4Shell, ChromaDB, Ghost CMS, and BeyondTrust
• Intelligence on verified compromised credentials, exposed cloud assets, AI provider keys, GitHub tokens, and phishing infrastructure
• Comprehensive indicators of compromise (IOCs), MITRE ATT&CK mapping, victim distribution, and defensive recommendations for security teams

Whether you’re a threat intelligence analyst, SOC team, incident responder, security researcher, or cyber defense leader, this whitepaper provides an in-depth look at how modern credential-harvesting operations are built, operated, and scaled—and how defenders can detect and disrupt them.