Joined 4 years ago
What made this case unusual was the attackers' operational security—or lack thereof. Their C2 server exposed a /stats endpoint with no authentication, giving me real-time visibility into their campaign metrics: 91,505 IPs scanned, 59,128 successful compromises, 64.6% success rate. The writeup covers:
Full attack chain (reconnaissance → exploitation → data exfiltration → persistence) C2 API architecture (4 endpoints, all unauthenticated) Data exfiltration pipeline (.env files, SSH keys, cloud credentials) Persistence mechanisms (systemd services, FRP tunnels, GOST proxies) Detection signatures (Suricata/Snort rules, YARA)
The attackers are harvesting credentials at industrial scale—roughly 300K credential sets per day at current pace. Their targeting appears indiscriminate (mode: random_ips), which suggests they're going for volume over precision. For those interested in the tooling: the honeypot that captured this is Beelzebub [0], an open-source project I've been maintaining for 3+ years. It uses LLMs to generate dynamic responses that keep attackers engaged longer, which helps capture more complete attack chains like this one. Happy to discuss the technical details, methodology, or anything about running deception infrastructure. [0] https://github.com/mariocandela/beelzebub
A threat actor is running a massive credential theft campaign against Next.js servers - I'm calling it "Operation PCPcat". The kicker? Their C2 infrastructure is completely exposed. Like, /stats endpoint showing live campaign metrics exposed. Amateur hour OpSec, but the operation itself is industrial-scale.
What they're doing:
Chaining CVE-2025-29927 + CVE-2025-66478 for RCE
Harvesting .env files, SSH keys, AWS creds, Docker configs, Git credentials
Dropping persistent backdoors
Everything flows through their open C2 - task queues, exfil data, the works
Happy to discuss in comments.
The newly discovered RondoDox v2 shows a dramatic leap in sophistication and scale:
+650% increase in exploit vectors (75+ CVEs observed)
New C&C infrastructure on compromised residential IPs
16 architecture variants
Open attacker signature: bang2013@atomicmail[.]io
Targets expanded from DVRs and routers to enterprise systems
The full report includes:
- In-depth technical analysis (dropper, ELF binaries, XOR decoding)
- Full IOC list
- YARA and Snort/Suricata detection rules
- Discovery timeline and attribution insights
Key Findings: - 15+ exploitation vectors (from 2 CVEs to enterprise-grade attacks) - C&C on compromised residential IP (multiple AWS EC2) - 16 architectures supported with XOR obfuscation (key: 0x21) - Open attribution: [email protected]
What concerns me: The jump from consumer DVR/routers to enterprise targets demonstrates an aggressive expansion strategy. We're no longer talking about a "simple" DDoS botnet.
IOCs and detection rules: YARA, Snort/Suricata and complete IOC list available in the full post.
