Exposed open directory reveals suspected DoNot APT (APT-C-35) toolkit targeting Pakistan's nuclear and energy sectors
Researchers at Hunt.io found an unsecured open directory at 193.29.104.84:8099, hosted on a French M247 server, holding 48 files (~12 MB) of a suspected DoNot APT (APT-C-35) espionage toolkit aimed at Pakistani critical infrastructure. The staging server was populated with an initial 34 files on 9 October 2026 and refined through 14 October 2026. Batch and PowerShell scripts hunt for documents referencing PAEC, Chashma, KANUPP, NTDC, WAPDA substations, SCADA and Modbus on a compromised workstation using an account named ELECTRICAL. Attribution to APT-C-35 is held at medium-to-high confidence, built on overlap of a backup C2 at 31.7.61.8:443 resolving (VirusTotal passive DNS) to pakdw.orchidheaven.online, a domain StrikeReady Labs tied in July 2026 to an India-linked espionage campaign. Hunt.io's own publication of the research is corroborated on its corporate channel, which describes the same opendir and the same PAEC/Chashma/KANUPP/SCADA/Modbus artefacts (linkedin.com/company/hunt-intelligence-inc). The toolkit is pre-intrusion tradecraft on an exposed server rather than a confirmed mass compromise, but the targeting of nuclear and grid operators and the presence of working credentials make it a high-urgency item for Pakistani critical-infrastructure defenders.
Detalhes técnicos
- Persistence and access: multiple reverse shells looping every two seconds, mixing PowerShell scripts with three Go binaries (rvb80_232.exe, rvb61135.exe, rvb_new.exe) calling back to 179.43.145.232 and 193.29.104.84; over five days the operators stripped symbols and added TLS. The directory also held a custom HTTP implant Beacon-trydnd1.exe and a Metasploit x64 loader rv88b.exe.
- Staging: go.bat used a bundled curl binary to pull payloads into
%USERPROFILE%\Wallet\Hunrd\; earlier DoNot reporting by QianXin (Heavy Shadows) recordsC:\Users\Public\Music\acoas a signature staging path. - Credential theft: Inveigh poisoning LLMNR, NBNS and mDNS to capture NetNTLM hashes, across 10 script revisions, later launched in a hidden background process; invgo2.bat (14 October) altered local environment variables to spoof the Oil and Gas Development Company Limited (OGDCL) domain for credibility.
- Reconnaissance and lateral movement: hunt88.bat and contenthunt.bat scanned the ELECTRICAL user's documents, browser history and recent files for 15 infrastructure keywords; lantest.bat sprayed three hardcoded credential sets against C$ admin shares on 30 hosts in 192.168.6.0/24; ad_pwd.txt (10 October) contained a plaintext credential; tcptest.ps1 checked the backup C2.
Remediação
Disable LLMNR and NBNS to defeat Inveigh hash capture, block egress to 193.29.104.84, 179.43.145.232, 31.7.61.8 and pakdw.orchidheaven.online, alert on files under %USERPROFILE%\Wallet\Hunrd\ and %PUBLIC%\Music\, and restrict administrative share (C$) access between workstations.
Linha do tempo
-
Exposed open directory reveals suspected DoNot APT (APT-C-35) toolkit targeting Pakistan's nuclear and energy sectors
ler a análise desta fonte ocultar
Researchers at Hunt.io found an unsecured open directory at 193.29.104.84:8099, hosted on a French M247 server, holding 48 files (~12 MB) of a suspected DoNot APT (APT-C-35) espionage toolkit aimed at Pakistani critical infrastructure. The staging server was populated with an initial 34 files on 9 October 2026 and refined through 14 October 2026. Batch and PowerShell scripts hunt for documents referencing PAEC, Chashma, KANUPP, NTDC, WAPDA substations, SCADA and Modbus on a compromised workstation using an account named ELECTRICAL. Attribution to APT-C-35 is held at medium-to-high confidence, built on overlap of a backup C2 at 31.7.61.8:443 resolving (VirusTotal passive DNS) to pakdw.orchidheaven.online, a domain StrikeReady Labs tied in July 2026 to an India-linked espionage campaign. Hunt.io's own publication of the research is corroborated on its corporate channel, which describes the same opendir and the same PAEC/Chashma/KANUPP/SCADA/Modbus artefacts (linkedin.com/company/hunt-intelligence-inc). The toolkit is pre-intrusion tradecraft on an exposed server rather than a confirmed mass compromise, but the targeting of nuclear and grid operators and the presence of working credentials make it a high-urgency item for Pakistani critical-infrastructure defenders.
Technical Details
- Persistence and access: multiple reverse shells looping every two seconds, mixing PowerShell scripts with three Go binaries (rvb80_232.exe, rvb61135.exe, rvb_new.exe) calling back to 179.43.145.232 and 193.29.104.84; over five days the operators stripped symbols and added TLS. The directory also held a custom HTTP implant Beacon-trydnd1.exe and a Metasploit x64 loader rv88b.exe.
- Staging: go.bat used a bundled curl binary to pull payloads into
%USERPROFILE%\Wallet\Hunrd\; earlier DoNot reporting by QianXin (Heavy Shadows) recordsC:\Users\Public\Music\acoas a signature staging path. - Credential theft: Inveigh poisoning LLMNR, NBNS and mDNS to capture NetNTLM hashes, across 10 script revisions, later launched in a hidden background process; invgo2.bat (14 October) altered local environment variables to spoof the Oil and Gas Development Company Limited (OGDCL) domain for credibility.
- Reconnaissance and lateral movement: hunt88.bat and contenthunt.bat scanned the ELECTRICAL user's documents, browser history and recent files for 15 infrastructure keywords; lantest.bat sprayed three hardcoded credential sets against C$ admin shares on 30 hosts in 192.168.6.0/24; ad_pwd.txt (10 October) contained a plaintext credential; tcptest.ps1 checked the backup C2.
Remediation
Disable LLMNR and NBNS to defeat Inveigh hash capture, block egress to 193.29.104.84, 179.43.145.232, 31.7.61.8 and pakdw.orchidheaven.online, alert on files under
%USERPROFILE%\Wallet\Hunrd\and%PUBLIC%\Music\, and restrict administrative share (C$) access between workstations.