# Exposed Dev Server Catches Threat Actor Using AI to Build and Test a WebDAV Phishing Toolkit Mid-Campaign


## The Threat


A malware operator made the kind of operational security mistake that turns a threat into a case study: they left their delivery server fully open, and Rapid7 walked right in. What they found wasn't just a payload — it was the entire development environment. All 1,048 files: lure templates, filename-spoofing tests, execution experiments, dropper scripts, builder notes, and two active campaign chains, including one already running against Windows users in Mexico.


The active campaign was impersonating gobf[.]mx, a convincing typosquat of Mexico's official CURP national-ID lookup portal. Victims who visited the fake site were walked through a fake record-retrieval flow, then served a malicious payload through WebDAV — a file-access protocol Windows will mount and execute from almost transparently. The final stage dropped an infostealer. What makes the Rapid7 report more than a standard incident writeup is what it says about *how* the operator works. The server didn't just hold finished tools — it held the entire build history, including failed experiments, README documentation, a testing matrix, and live delivery logs. Defenders almost never see the workshop. This time, the door was wide open.


The operator's core technique was CVE-2025-33053, a WebDAV working-directory hijack Microsoft patched in June 2025 and CISA subsequently added to its KEV catalog. The attack abuses a .url shortcut to launch a legitimate, signed Windows binary — in the original Check Point "Stealth Falcon" reporting, that was iediagcmd.exe, Internet Explorer's diagnostics tool — while pointing its working directory at an attacker-controlled WebDAV share. Because iediagcmd.exe spawns helpers like route.exe by bare filename rather than absolute path, Windows loads the attacker's version from the remote share instead of the real one in System32. The operator's own README described the result in blunt marketing terms: "WITHOUT any security warnings. Zero alerts!"


## Severity and Impact


| CVE | CVSS Score | Vector | Attack Complexity | Auth Required | CWE |

|---|---|---|---|---|---|

| CVE-2025-33053 | 8.8 | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | Low | None | CWE-427 (Uncontrolled Search Path) |

| CVE-2025-24054 | TBD | Network | Low | None | CWE-522 (NTLM credential leak) |

| CVE-2026-21513 | TBD | Network | Low | None | MSHTML bypass |


CVE-2025-33053 is the anchor. Its CVSS 8.8 rating reflects the ease of exploitation: no authentication, low complexity, requires only a single user click on a shortcut file. Its presence in CISA's KEV catalog means federal agencies are under remediation mandates, but that doesn't address the broader enterprise population.


## Affected Products


CVE-2025-33053 (WebDAV working-directory hijack)

  • Windows 10 (all supported builds prior to June 2025 patch)
  • Windows 11 (builds prior to 24H2 — 24H2 removes Internet Explorer, breaking the original iediagcmd.exe vector)
  • Windows Server variants with IE components present

    • Secondary test targets (operator's 59-file expansion kit)

  • Systems running .NET framework tools: InstallUtil.exe, RegAsm.exe
  • Any Windows host exposing LOLBAS-listed signed binaries with bare-filename helper loading
  • Systems vulnerable to UAC bypass candidates under investigation by the operator

    • CVE-2025-24054 (NTLM credential leak) and CVE-2026-21513 (MSHTML bypass)

  • Windows systems with NTLM enabled and unpatched MSHTML components

    • ## Mitigations


    Patch immediately. CVE-2025-33053 was fixed in Microsoft's June 2025 Patch Tuesday. If your Windows fleet isn't current, that's the first action. CISA's KEV listing means federal environments have binding remediation timelines — enterprises should treat KEV additions as the same signal.


    Block or restrict WebDAV outbound. The attack requires a client to mount an attacker-controlled WebDAV share. Blocking outbound TCP 80/443 to WebDAV endpoints via firewall policy or disabling the WebClient service (sc config WebClient start=disabled) on endpoints where it isn't needed removes the delivery path entirely.


    Upgrade to Windows 11 24H2 where feasible. The original iediagcmd.exe hijack doesn't work on 24H2 because Internet Explorer is gone. This doesn't neutralize the operator's expanded 59-binary test kit, but it closes the specific vector that's been operationally proven.


    Disable NTLM where possible. CVE-2025-24054 represents a credential-theft opportunity that often travels with phishing delivery chains. Microsoft's guidance to disable NTLMv1 and restrict NTLMv2 applies here.


    Monitor for suspicious .url file execution and WebDAV mounts. Detection rules targeting .url shortcut execution followed by WebDAV share access from unusual remote hosts will catch this behavior before payload delivery. Rapid7 has published indicators from this campaign, including the gobf[.]mx domain.


    Audit exposed admin panels. The operator left their own delivery panel — "Simba Service" — running on a default port with default credentials. If your organization runs any web-based admin tooling, verify it isn't accessible from the public internet and that default credentials have been rotated.


    ## References


  • [Rapid7 Threat Intelligence Report — AI-Assisted Phishing Toolkit](https://www.rapid7.com)
  • [CISA Known Exploited Vulnerabilities Catalog — CVE-2025-33053](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • [Microsoft Security Update Guide — June 2025 Patch Tuesday](https://msrc.microsoft.com/update-guide)
  • [Check Point Stealth Falcon WebDAV Research](https://research.checkpoint.com)
  • [Coderrr / CodeRRR open-source AI coding agent (GitHub)](https://github.com)

    • ---


    ## HackWire Analysis


    The most important word in Rapid7's report is "mid-build." Threat intelligence usually arrives after an operation is finished: cleaned logs, recycled infrastructure, behavioral fingerprints from victims. What Rapid7 recovered here is the development trail — and that's what makes this worth reading beyond the CVE numbers.


    The AI angle is real, but it's being slightly over-dramatized in early coverage. The operator didn't use a bespoke attacker AI. They used Coderrr, an open-source coding agent that anyone can download right now, and they used it the same way a software team would: to draft documentation, generate test matrices, structure their research notes, and move faster. The emoji-laden READMEs and matrix-style test write-ups Rapid7 flags as LLM output aren't signs of some next-generation attacker — they're signs of someone who learned that AI speeds up boring parts of the job. That's the threat model. Not AI writing exploits; AI enabling a single operator to produce, document, and iterate at product-team velocity.


    The 59-binary expansion kit is the detail defenders should sit with longest. The operator hit a wall — Windows 11 24H2 killed the iediagcmd.exe vector — and their response wasn't to abandon the technique, it was to rebuild it with a systematic test framework covering dozens of alternative signed binaries. That's engineering discipline. The implication is that some subset of those 59 candidates will prove reliable, and we'll see a next-generation variant of this delivery chain before long.


    For defenders, the short-term answer is patch and block WebDAV. The medium-term answer is harder: assume that living-off-the-land abuse of signed Windows binaries is a continuously evolving problem, not one that gets solved by patching a single CVE.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)