Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV. What makes it more than a Exp…

https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html

sha256:7311c8718ce8dd5f802424855d26d408d965841ae969158152cad51ea0cce08d

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve3
md50
url0
ipv40
ipv60
sha10
domain5
sha2560
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	route.exe	Open →
domain	iediagcmd.exe	Open →
domain	summerartcamp.net	Open →
domain	gobf.mx	Open →
domain	davclnt.dll	Open →
cve	CVE-2025-33053	Open →
cve

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports