Actor "Lenken" advertises access to 13 ERP environments in nine countries, claiming unpatched 0-day exploitation
An actor using the handle Lenken claims on a dark web forum to hold access to ERP environments at 13 organizations across South Africa, the United States, Iraq, India, Austria, Saudi Arabia, the United Arab Emirates, Egypt and Tanzania. The actor states every listed system was compromised through an unpatched 0-day, with access maintained via a reverse shell, implant or agent at a normal-user privilege level. The post lists sector descriptions and claimed revenues (from €1.2M to $50M) and includes filesystem and disk-usage output as apparent proof-of-access. Dark Web Informer has not independently verified the 0-day, the compromises, victim identities, access level, revenue figures or the filesystem evidence, and the ERP product named as vulnerable is not disclosed in the material. No victim domains, malware hashes, Tox IDs, Telegram handles or attacker-controlled IP addresses appear in the supplied screenshots.
Detalhes técnicos
The only technique supported by the material is T1190 – Exploit Public-Facing Application, mapped as inferred from the actor's own claim of 0-day exploitation against internet-exposed ERP systems; the vulnerable product and the exploitation path are not shown. Post-access behaviour is described by the actor as shell or agent persistence with unprivileged rights, which would still permit data collection, credential abuse and lateral movement attempts.
Remediação
Organizations in the named sectors should review internet-exposed ERP front-ends and application servers for unexpected outbound connections, unknown agents or services, and anomalous access by low-privilege application accounts, and keep ERP platforms and their integration components on vendor-supported, fully patched releases.
Linha do tempo
-
Actor "Lenken" advertises access to 13 ERP environments in nine countries, claiming unpatched 0-day exploitation
ler a análise desta fonte ocultar
An actor using the handle Lenken claims on a dark web forum to hold access to ERP environments at 13 organizations across South Africa, the United States, Iraq, India, Austria, Saudi Arabia, the United Arab Emirates, Egypt and Tanzania. The actor states every listed system was compromised through an unpatched 0-day, with access maintained via a reverse shell, implant or agent at a normal-user privilege level. The post lists sector descriptions and claimed revenues (from €1.2M to $50M) and includes filesystem and disk-usage output as apparent proof-of-access. Dark Web Informer has not independently verified the 0-day, the compromises, victim identities, access level, revenue figures or the filesystem evidence, and the ERP product named as vulnerable is not disclosed in the material. No victim domains, malware hashes, Tox IDs, Telegram handles or attacker-controlled IP addresses appear in the supplied screenshots.
Technical Details
The only technique supported by the material is T1190 – Exploit Public-Facing Application, mapped as inferred from the actor's own claim of 0-day exploitation against internet-exposed ERP systems; the vulnerable product and the exploitation path are not shown. Post-access behaviour is described by the actor as shell or agent persistence with unprivileged rights, which would still permit data collection, credential abuse and lateral movement attempts.
Remediation
Organizations in the named sectors should review internet-exposed ERP front-ends and application servers for unexpected outbound connections, unknown agents or services, and anomalous access by low-privilege application accounts, and keep ERP platforms and their integration components on vendor-supported, fully patched releases.