Full Report
A compromised terminal server became a phishing stager. A fake Boots survey aimed at 8.9 million inboxes, with the payload on a hacked Bolivian government site.
Analysis Summary
# Incident Report: The "Dracii" Phishing Stager Intrusion
## Executive Summary
A terminal server belonging to a small organization was compromised and repurposed as a high-volume phishing stager. Threat actors utilized the server to stage bulk email software and target lists containing nearly 8.9 million records for a Boots-themed credential harvesting campaign. The incident was detected within nine hours of a new security agent deployment, leading to the discovery of a compromised Bolivian government website used for payload hosting.
## Incident Details
- **Discovery Date:** 2026-05-16
- **Incident Date:** 2026-05-15 (Start of Huntress monitoring)
- **Affected Organization:** Unnamed Small Client (25 endpoints)
- **Sector:** Technology/Professional Services (Managed via Partner)
- **Geography:** Undisclosed (Attacker source: Romania)
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-May 15, 2026
- **Vector:** Credential stuffing/Brute force on exposed RDP
- **Details:** The attacker exploited a Microsoft IIS RDWeb Access portal exposed directly to the internet. The actor possessed valid domain credentials for a user account.
### Lateral Movement
- **Details:** The attacker utilized the Remote Desktop Gateway role on the compromised terminal server to maintain a session. As the server was a central hub for multiple users, the attacker had immediate access to a resource-rich environment for staging.
### Data Exfiltration/Impact
- **Impact:** The server was used to stage **Gammadyne Mailer** (bulk email software) and a project file named `dracii.mmp`.
- **Data Staged:** Six text files containing **8,894,920** email addresses (target lists) were identified on the server.
### Detection & Response
- **Detection:** 2026-05-16 03:38:53 UTC. A critical alert was triggered by a login from a known malicious hostname (`DESKTOP-[REDACTED]`) and IP (`212.93.152[.]37`).
- **Response Actions:** The Huntress SOC notified the partner, analyzed the staging directory, and contacted the Bolivian national CSIRT (CGII) regarding the compromised government domain.
## Attack Methodology
- **Initial Access:** Valid accounts via exposed RDWeb/RDP.
- **Persistence:** RDP session persistence on a Terminal Server.
- **Defense Evasion:** Use of legitimate bulk mailing software (Gammadyne) to blend in with potential administrative activity.
- **Credential Access:** Likely obtained via prior credential stuffing or brute force against the exposed portal.
- **Discovery:** The attacker identified the server as a viable high-bandwidth stager for large-scale mail campaigns.
- **Collection:** Staging of 8.9 million target email addresses.
- **Impact:** Resource hijacking; the server was used to facilitate a global phishing campaign impersonating Boots pharmacy.
## Impact Assessment
- **Financial:** High potential infrastructure costs and bandwidth consumption for the victim.
- **Data Breach:** Exposure of 8.9 million third-party email addresses staged on the victim's hardware.
- **Operational:** Potential for the organization's IP address to be blacklisted globally due to spam/phishing activity.
- **Reputational:** High risk if the organization’s infrastructure was publicly identified as the source of a massive retail scam.
## Indicators of Compromise
- **Network Indicators:**
- 212.93.152[.]37 (Attacker Source IP - Romania)
- ipelc.gob[.]bo (Compromised payload host)
- **File Indicators:**
- `dracii.mmp` (Gammadyne project file)
- `boots_store` (Directory on compromised host)
- **Behavioral Indicators:**
- Logins from `DESKTOP-[REDACTED]` workstation.
- Installation of bulk mailing tools on a non-marketing server.
## Response Actions
- **Containment:** Identified and flagged the malicious RDP session.
- **Eradication:** Provided evidence to the partner to facilitate account resets and removal of staging tools.
- **Recovery:** Coordination with international authorities (Bolivian CSIRT) to take down the phishing payload.
## Lessons Learned
- **Visibility Gaps:** Deploying EDR mid-incident makes baseline establishing difficult, but rapid detection is still possible via known threat actor infrastructure.
- **Resource Hijacking:** Attackers do not always seek ransomware; "living off the land" to send 8 million emails is a significant operational risk.
- **Exposed Services:** Public-facing RDWeb portals without Multi-Factor Authentication (MFA) remain a primary target for attackers.
## Recommendations
- **Enforce MFA:** Implement Multi-Factor Authentication for all RDP and RDWeb Access logins.
- **Restrict Access:** Utilize a VPN or IP allow-listing for remote access rather than exposing RDP/RDWeb to the entire internet.
- **Monitor Staging Areas:** Implement alerts for the installation of bulk mailing tools or large transfers of `.txt` or `.csv` files on servers not designated for those tasks.