Full Report
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV. What makes it more than a
Analysis Summary
Based on the provided report from Rapid7 and The Hacker News, here is the summary of the identified tools and techniques.
# Tool/Technique: WebDAV Working-Directory Hijack (CVE-2025-33053)
## Overview
This is a sophisticated delivery technique that abuses Windows `.url` (Internet Shortcut) files and the WebDAV protocol to bypass security warnings like SmartScreen and Mark-of-the-Web (MotW). It tricks legitimate, signed Windows binaries into loading malicious DLLs or executables from an attacker-controlled remote server by hijacking the application's working directory.
## Technical Details
- **Type**: Technique / Exploit Chain
- **Platform**: Windows (specifically targets Windows 10; variants being tested for Windows 11 24H2)
- **Capabilities**: Security bypass (SmartScreen/MotW), Remote Code Execution (RCE) via DLL sideloading/search-order hijacking.
- **First Seen**: Documented by Check Point in 2025; active campaign observed July 2026.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1566.002 - Phishing: Spearphishing Link**
- **TA0005 - Defense Evasion**
- **T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass**
- **T1218 - System Binary Proxy Execution**
- **TA0002 - Execution**
- **T1204.002 - User Execution: Malicious File**
## Functionality
### Core Capabilities
- **Search-MS URI Handling**: Uses the `search-ms:` protocol to open a Windows Explorer window filtered to specific malicious files on a remote share.
- **Working Directory Hijacking**: Points a `.url` file's `WorkingDirectory` to a WebDAV path (e.g., `\\attacker-ip@ssl@443\DavWWWRoot\`).
- **Binary Proxy Execution**: Launches legitimate tools like `iediagcmd.exe` which then attempt to load helper binaries (like `route.exe`) from the current (malicious) directory instead of `System32`.
### Advanced Features
- **AI-Assisted Development**: Documentation and lures were generated using LLM-based agents (e.g., CodeRRR) to scale phishing templates and testing matrices.
- **Extensive Testing Suite**: A "comprehensive test kit" containing 59 different `.url` variations targeting various LOLBAS (Living Off the Land Binaries and Scripts) like `InstallUtil` and `RegAsm`.
## Indicators of Compromise
*Note: Indicators are based on the specific campaign described in the article.*
- **File Names**: `search-ms` queries, `.url` files, `.scr` files (screensavers used as executables), `_MAPPING.csv`, `testik` (folder).
- **Network Indicators (Defanged)**:
- `gobf[.]mx` (Typosquat of Mexican government CURP site)
- `summerartcamp[.]net@ssl@443\DavWWWRoot\OSYxaOjr` (Historical indicator referenced in READMEs)
- **Behavioral Indicators**:
- `explorer.exe` spawning legitimate system binaries (e.g., `iediagcmd.exe`) where the command line or working directory points to a UNC/WebDAV path.
- Unusual outbound traffic on ports 80/443 to WebDAV endpoints (`DavWWWRoot`).
## Associated Threat Actors
- **Stealth Falcon**: Original group associated with the zero-day discovery.
- **Unidentified Russian-speaking operator**: The current campaign uses Russian language in folder names ("testik") and comments, utilizing AI-assisted workflows.
## Detection Methods
- **Behavioral Detection**: Monitor for `explorer.exe` calling `search-ms` or `cmd.exe` with UNC paths. Watch for the execution of signed binaries (`InstallUtil`, `RegAsm`) where the parent process is unexpected or the working directory is remote.
- **Network Detection**: Inspect WebDAV-related traffic (User-Agent: `DavClnt`) to external/unauthorized IP addresses or domains.
- **File-Based**: Scan for `.url` files containing `URL=file://` or `WorkingDirectory=` pointing to external network locations.
## Mitigation Strategies
- **Patch Management**: Ensure Windows updates are applied, specifically addressing **CVE-2025-33053**, **CVE-2026-21513**, and **CVE-2025-24054**.
- **Attack Surface Reduction (ASR)**: Enable rules that block "Office applications from creating executable content" and "Block process creations originating from PSExec and WMI commands."
- **Network Hardening**: Block outbound WebDAV/SMB traffic (ports 80, 443, 445) to the internet at the firewall level unless explicitly required for business.
- **Application Whitelisting**: Use tools like AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of `.scr` or unauthorized `.exe` files from temp directories.
## Related Tools/Techniques
- **Simba Service**: The admin panel used by the operator for delivery.
- **CodeRRR/Coderrr**: The open-source AI coding tool used to automate the toolkit's development.
- **LOLBAS**: The general methodology of using legitimate binaries for malicious purposes.