Exposed Server Reveals AI-Assisted WebDAV Phishing Kit Targeting Mexican Users (CVE-2025-33053)

Exposed Server Reveals AI-Assisted WebDAV Phishing Kit (TL-2026-1566), also tracked as Simba Service, is a high-severity malware campaign scored CVSS 8.8, first published 2026-07-20 and last reviewed 2026-07-21. It has no confirmed attribution, affects Microsoft Windows 10 / Windows 11 / Windows Server (WebDAV client, references 3 CVEs (CVE-2025-33053, CVE-2026-21513, CVE-2025-24054), maps to 52 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 46 indicators of compromise.

Key facts for TL-2026-1566

Threat ID
TL-2026-1566
Also known as
Simba Service, Simba Panel, CURP Typosquat Campaign, DlrtyGames
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
MALWARE
First published
2026-07-20
Last reviewed
2026-07-21
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
government administration, individuals consumers, finance, cryptocurrency
Target regions
mexico, North America
Detection rules
9
Indicators of compromise
46
Updates
2026-07-21 · revalidated 1× · latest source

Malware and tooling in Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

Malware and tooling: DlrtyGames Modular .NET RAT, Simba Service .NET Infostealer, Coderrr

Rapid7 obtained 1,048 files from an exposed Russian-speaking phishing operator's 'Simba Service' delivery server, revealing a WebDAV working-directory-hijack toolkit (CVE-2025-33053) built and iterated with the help of an open-source AI coding agent ('Coderrr'). The live CURP-typosquat campaign (gobf[.]mx) delivered a memory-only .NET infostealer process-hollowed into a signed Qihoo 360 binary to Mexican users, while a second chain (DlrtyGames) sideloaded a modular .NET RAT via a signed Ubisoft binary.

How Exposed Server Reveals AI-Assisted WebDAV Phishing Kit works

In late June 2026, Rapid7 researchers gained access to an exposed operator server hosting an admin panel dubbed 'Simba Service' (default port and default credentials left unchanged), along with 1,048 files comprising lure templates, filename-spoofing experiments, execution tests, droppers, builder notes, and two live delivery chains. Evidence embedded in the files — hardcoded local paths to an open-source AI coding agent nicknamed 'Coderrr' (design cues drawn from Claude Code, GitHub Copilot CLI, and Cursor), templated/emoji-heavy LLM-style documentation, and casual folder names such as 'testik' — points to an operator using generative AI to accelerate development, testing, and documentation of a WebDAV-based malware-delivery kit.

The most mature and heavily tested exploit in the kit is CVE-2025-33053 (CVSS 8.8), a WebDAV working-directory-hijack remote code execution flaw (CWE-73, External Control of File Name or Path) patched by Microsoft in June 2025 and added to the CISA KEV catalog with a July 1, 2025 remediation deadline due to active exploitation by the UAE-linked APT group Stealth Falcon (observed March 2025 against a Turkish defense organization delivering the 'Horus Agent' backdoor via a PDF-themed .url shortcut). In this operator's kit, a malicious `.url` Internet Shortcut file sets its working directory to an attacker-controlled WebDAV share; when the shortcut launches a signed Microsoft utility such as `iediagcmd.exe` (Internet Explorer diagnostics) or `CustomShellHost.exe`, Windows' DLL/binary search-order and `Process.Start()` resolution load the attacker's file (e.g., a rogue `route.exe`) from the remote WebDAV path instead of the legitimate System32 binary — executing with no SmartScreen or Mark-of-the-Web warning. The operator's own notes claim 'WITHOUT any security warnings. Zero alerts!' The technique fails on Windows 11 24H2 because Internet Explorer components were removed from that build.

The kit's testing arsenal contains 59 candidate `.url` files targeting different signed/LOLBAS binaries (.NET tools including InstallUtil and RegAsm, UAC-bypass candidates, and other Living-Off-the-Land binaries), evidencing systematic experimentation to find the most reliable and stealthy hijack target. Two secondary vulnerabilities were also tested for inclusion: CVE-2026-21513, an MSHTML/`ieframe.dll` security-feature-bypass flaw (CVSS 8.8) that lets attacker-controlled hyperlink navigation reach `ShellExecuteExW` and execute local/remote resources outside the browser sandbox (exploited in the wild by APT28 before its February 2026 patch); and CVE-2025-24054, an NTLM hash-disclosure/spoofing flaw in Windows Explorer's handling of `.library-ms` files with UNC paths, which triggers an SMB/NTLMv2 authentication leak merely by a user right-clicking or navigating to a folder containing the crafted file (actively exploited since March 2025 against Polish and Romanian government/private targets).

The live, production campaign observed by Rapid7 impersonated Mexico's CURP (Clave Única de Registro de Población) national-ID lookup portal via the typosquat domain gobf[.]mx. Over June 20–26, 2026 the lure generated 77,098 requests from 3,892 unique IPs across 101 countries, with 82.5% of traffic and 96.9% of launch/execution events (2,384 of 2,441 recorded launches, ~97.7%) originating from Mexico and clustering during Mexican working hours — consistent with genuine victim traffic rather than automated scanning; secondary US/Germany traffic appeared to be researcher or automated reconnaissance. Delivery volume dropped sharply after June 24, 2026.

Victims who reached the lure were served a file whose name was obfuscated with a right-to-left-override control character (U+202E) to visually display as a PDF while the underlying extension was a Windows `.scr` screensaver executable — a classic RTLO double-extension spoof. Execution ran an Inno Setup installer (`.scr`) that unpacked a loader, which in turn ran a .NET infostealer entirely in memory via process hollowing into a legitimately signed Qihoo 360 (360 Total Security) binary — evading static AV signature and code-signing checks. The infostealer targeted cryptocurrency wallets, browser-stored credentials, session cookies, and Telegram session files for exfiltration.

A second, related delivery chain ('DlrtyGames') used DLL sideloading via a legitimately signed Ubisoft binary to load a modular .NET Remote Access Trojan, indicating the operator maintains at least two parallel payload/delivery pipelines built on the same WebDAV-hijack foundation. IOC infrastructure recovered from the exposed server and published by Rapid7 includes the operator's WebDAV/loader domain onedrive.cv (masquerading as Microsoft OneDrive) hosting a second-stage installer (`HyperPackSetup.exe`), plus supporting IPs, 200+ malware sample hashes (SHA256/SHA1/MD5), and host-artifact identifiers (volume serials/GUIDs, MAC addresses, hostnames) captured from the operator's own test/build machine — itself an operational-security failure that further exposed the kit's development environment.

MITRE ATT&CK techniques used in TL-2026-1566

Credential Access

T1003 OS Credential Dumping; T1056 Input Capture; T1187 Forced Authentication; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.002 Right-to-Left Override; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Double File Extension; T1055 Process Injection; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1574.001 DLL; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution; T1204.002 Malicious File

Persistence

T1053 Scheduled Task/Job; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548.002 Bypass User Account Control

Command and Control

T1071 Application Layer Protocol; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.002 Spearphishing Link

defense-impairment

T1553 Subvert Trust Controls; T1553.002 Code Signing

Resource Development

T1583 Acquire Infrastructure; T1583.001 Domains; T1585 Establish Accounts; T1587 Develop Capabilities; T1587.001 Malware

Impact

T1657 Financial Theft

Affected products and versions in Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

  • Microsoft — Windows 10 / Windows 11 / Windows Server (WebDAV client, Internet Shortcut handling)
    Vulnerable versions: Windows 10 1507-22H2; Windows 11 22H2/23H2 (24H2 not exploitable — IE removed); Windows Server 2008 R2 SP1; Windows Server 2012/2012 R2; Windows Server 2019; Windows Server 2022
    Fixed in: June 2025 cumulative update (CVE-2025-33053)
  • Microsoft — MSHTML / Internet Explorer engine (ieframe.dll)
    Vulnerable versions: All supported Windows versions prior to February 2026 Patch Tuesday
    Fixed in: February 2026 cumulative update (CVE-2026-21513)
  • Microsoft — Windows Explorer (.library-ms handling)
    Vulnerable versions: All supported Windows versions prior to March 2025 Patch Tuesday
    Fixed in: March 2025 cumulative update (CVE-2025-24054)

Remediation for Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

Patches

  • Microsoft June 2025 Patch Tuesday — CVE-2025-33053
  • Microsoft February 2026 Patch Tuesday — CVE-2026-21513
  • Microsoft March 2025 Patch Tuesday — CVE-2025-24054 (formerly tracked as CVE-2025-24071)

Immediate actions

  • Apply the June 2025 Microsoft patch for CVE-2025-33053 across all supported Windows 10/11 and Windows Server builds
  • Apply the February 2026 patch for CVE-2026-21513 (MSHTML/ieframe.dll security feature bypass)
  • Apply the March 2025 patch for CVE-2025-24054 (.library-ms NTLM hash leak)
  • Block outbound WebDAV (port 443/80 WebClient traffic, davclnt.dll) to non-corporate destinations at the perimeter and via host firewall
  • Block/sinkhole known operator domains gobf[.]mx and onedrive.cv and IPs 138.124.123.87 and 203.161.39.169
  • Disable the WebClient service on endpoints that do not require WebDAV connectivity
  • Block execution of .url files from email/downloads via Attack Surface Reduction rules or Group Policy

Workarounds

  • Disable the WebClient (WebDAV Mini-Redirector) service where WebDAV access is not required
  • Block outbound access to davclnt.dll-initiated WebDAV connections at the network perimeter
  • Restrict .url and .library-ms file execution via Windows Attack Surface Reduction rules

Longer-term hardening

  • Deploy EDR with behavioral detection for signed LOLBAS binaries (iediagcmd.exe, CustomShellHost.exe, InstallUtil.exe, RegAsm.exe) spawning child processes from UNC/WebDAV paths
  • Enforce SMB signing and NTLM relay mitigations (Extended Protection for Authentication) to blunt residual NTLM-leak exploitation
  • Deploy code-signing and parent-process anomaly detection to catch process hollowing into legitimately signed third-party binaries
  • Monitor for RTLO (U+202E) characters and double-extension filenames in email attachments and downloads
  • User awareness training on government-portal typosquats and unsolicited installer downloads

CVEs associated with Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

CVE-2025-33053, CVE-2026-21513, CVE-2025-24054

Weaknesses (CWE) in Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

CWE-73, CWE-668, CWE-522, CWE-254, CWE-706

Timeline of Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

  • Microsoft patches CVE-2025-24054 (.library-ms NTLM hash leak); active exploitation against Polish/Romanian government targets follows within days
  • CVE-2025-24054 observed under active exploitation in the wild, roughly one week after patch release
  • Microsoft patches CVE-2025-33053 (WebDAV working-directory hijack); Stealth Falcon APT exploitation against a Turkish defense organization (Horus Agent backdoor) disclosed
  • CISA KEV remediation deadline for CVE-2025-33053 for FCEB agencies
  • CVE-2026-21513 (MSHTML/ieframe.dll bypass) exploit sample linked to APT28 first submitted to VirusTotal, ahead of the February patch
  • Microsoft patches CVE-2026-21513 (MSHTML security feature bypass)
  • CURP-typosquat (gobf[.]mx) delivery campaign begins targeting Mexican users via WebDAV CVE-2025-33053 hijack chain
  • Delivery burst cools sharply after peak activity
  • Observed campaign window closes; totals reach 77,098 requests from 3,892 unique IPs across 101 countries, 2,384 of 2,441 launch events (~97.7%) from the CURP lure
  • Rapid7 MDR alert triggers on WebDAV-based payload execution, leading investigators to the exposed staging server.
  • Rapid7 publishes IOCs to GitHub; The Hacker News reports on the AI-assisted WebDAV phishing kit discovery
  • Rapid7 obtains 1,048 files from the exposed 'Simba Service' operator admin panel, including lure templates, testing notes, droppers, and evidence of the 'Coderrr' AI coding agent used in development
  • Rapid7 confirms the exposed server is a full operator testing/staging lab containing ~1,048 malware-development artifacts.
  • Rapid7 publishes a full technical analysis of the WebDAV malware delivery lab, naming the DlrtyGames RAT as PureRAT and version-tagging the CURP .NET stealer (v4.4.3, build 06x12x2026SantaEbash2).

Update history for TL-2026-1566

Sources cited for Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

Threats related to Exposed Server Reveals AI-Assisted WebDAV Phishing Kit

Detection coverage for TL-2026-1566

As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1566 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1566

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats