# Exposed Server Reveals AI-Assisted WebDAV Phishing Kit Targeting Mexican Users (CVE-2025-33053)

> Rapid7 obtained 1,048 files from an exposed Russian-speaking phishing operator's 'Simba Service' delivery server, revealing a WebDAV working-directory-hijack toolkit (CVE-2025-33053) built and iterated with the help of an open-source AI coding agent ('Coderrr'). The live CURP-typosquat campaign (gobf[.]mx) delivered a memory-only .NET infostealer process-hollowed into a signed Qihoo 360 binary to Mexican users, while a second chain (DlrtyGames) sideloaded a modular .NET RAT via a signed Ubisoft binary.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-21T19:40:53.938Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1566
- **ID:** TL-2026-1566
- **Severity:** HIGH (CVSS 8.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-33053, CVE-2026-21513, CVE-2025-24054

## Description

In late June 2026, Rapid7 researchers gained access to an exposed operator server hosting an admin panel dubbed 'Simba Service' (default port and default credentials left unchanged), along with 1,048 files comprising lure templates, filename-spoofing experiments, execution tests, droppers, builder notes, and two live delivery chains. Evidence embedded in the files — hardcoded local paths to an open-source AI coding agent nicknamed 'Coderrr' (design cues drawn from Claude Code, GitHub Copilot CLI, and Cursor), templated/emoji-heavy LLM-style documentation, and casual folder names such as 'testik' — points to an operator using generative AI to accelerate development, testing, and documentation of a WebDAV-based malware-delivery kit.

The most mature and heavily tested exploit in the kit is CVE-2025-33053 (CVSS 8.8), a WebDAV working-directory-hijack remote code execution flaw (CWE-73, External Control of File Name or Path) patched by Microsoft in June 2025 and added to the CISA KEV catalog with a July 1, 2025 remediation deadline due to active exploitation by the UAE-linked APT group Stealth Falcon (observed March 2025 against a Turkish defense organization delivering the 'Horus Agent' backdoor via a PDF-themed .url shortcut). In this operator's kit, a malicious `.url` Internet Shortcut file sets its working directory to an attacker-controlled WebDAV share; when the shortcut launches a signed Microsoft utility such as `iediagcmd.exe` (Internet Explorer diagnostics) or `CustomShellHost.exe`, Windows' DLL/binary search-order and `Process.Start()` resolution load the attacker's file (e.g., a rogue `route.exe`) from the remote WebDAV path instead of the legitimate System32 binary — executing with no SmartScreen or Mark-of-the-Web warning. The operator's own notes claim 'WITHOUT any security warnings. Zero alerts!' The technique fails on Windows 11 24H2 because Internet Explorer components were removed from that build.

The kit's testing arsenal contains 59 candidate `.url` files targeting different signed/LOLBAS binaries (.NET tools including InstallUtil and RegAsm, UAC-bypass candidates, and other Living-Off-the-Land binaries), evidencing systematic experimentation to find the most reliable and stealthy hijack target. Two secondary vulnerabilities were also tested for inclusion: CVE-2026-21513, an MSHTML/`ieframe.dll` security-feature-bypass flaw (CVSS 8.8) that lets attacker-controlled hyperlink navigation reach `ShellExecuteExW` and execute local/remote resources outside the browser sandbox (exploited in the wild by APT28 before its February 2026 patch); and CVE-2025-24054, an NTLM hash-disclosure/spoofing flaw in Windows Explorer's handling of `.library-ms` files with UNC paths, which triggers an SMB/NTLMv2 authentication leak merely by a user right-clicking or navigating to a folder containing the crafted file (actively exploited since March 2025 against Polish and Romanian government/private targets).

The live, production campaign observed by Rapid7 impersonated Mexico's CURP (Clave Única de Registro de Población) national-ID lookup portal via the typosquat domain gobf[.]mx. Over June 20–26, 2026 the lure generated 77,098 requests from 3,892 unique IPs across 101 countries, with 82.5% of traffic and 96.9% of launch/execution events (2,384 of 2,441 recorded launches, ~97.7%) originating from Mexico and clustering during Mexican working hours — consistent with genuine victim traffic rather than automated scanning; secondary US/Germany traffic appeared to be researcher or automated reconnaissance. Delivery volume dropped sharply after June 24, 2026.

Victims who reached the lure were served a file whose name was obfuscated with a right-to-left-override control character (U+202E) to visually display as a PDF while the underlying extension was a Windows `.scr` screensaver executable — a classic RTLO double-extension spoof. Execution ran an Inno Setup installer (`.scr`) that unpacked a loader, which in turn ran a .NET infostealer entirely in memory via process hollowing into a legitimately signed Qihoo 360 (360 Total Security) binary — evading static AV signature and code-signing checks. The infostealer targeted cryptocurrency wallets, browser-stored credentials, session cookies, and Telegram session files for exfiltration.

A second, related delivery chain ('DlrtyGames') used DLL sideloading via a legitimately signed Ubisoft binary to load a modular .NET Remote Access Trojan, indicating the operator maintains at least two parallel payload/delivery pipelines built on the same WebDAV-hijack foundation. IOC infrastructure recovered from the exposed server and published by Rapid7 includes the operator's WebDAV/loader domain onedrive.cv (masquerading as Microsoft OneDrive) hosting a second-stage installer (`HyperPackSetup.exe`), plus supporting IPs, 200+ malware sample hashes (SHA256/SHA1/MD5), and host-artifact identifiers (volume serials/GUIDs, MAC addresses, hostnames) captured from the operator's own test/build machine — itself an operational-security failure that further exposed the kit's development environment.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Spearphishing Link
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1548.002 Bypass User Account Control
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1036.002 Right-to-Left Override
- T1036.007 Double File Extension
- T1055 Process Injection
- T1055.012 Process Hollowing
- T1574 Hijack Execution Flow
- T1574.001 DLL
- T1574.001 DLL
- T1218 System Binary Proxy Execution
- T1553.002 Code Signing
- T1140 Deobfuscate/Decode Files or Information
- T1187 Forced Authentication
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1587 Develop Capabilities
- T1587.001 Malware
- T1585 Establish Accounts
- T1189 Drive-by Compromise

## Sources

- [Exposed Server Reveals AI-Assisted WebDAV Phishing Kit](https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html)
- [Rapid7-Labs IOCs: Simba Panel](https://github.com/rapid7/Rapid7-Labs/tree/main/IOCs/Simba%20Panel)
- [CVE-2025-33053 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-33053)
- [CVE-2025-33053: RCE in WebDAV](https://www.kaspersky.com/blog/cve-2025-33053-june-2025-patch-tuesday/53630/)
- [Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053)](https://www.helpnetsecurity.com/2025/06/11/microsoft-fixes-zero-day-exploited-for-cyber-espionage-cve-2025-33053/)
- [CVE-2025-33053 Detection: WebDAV Zero-Day RCE Weaponized by Stealth Falcon APT](https://socprime.com/blog/cve-2025-33053-zero-day-webdav-vulnerability/)
- [CVE-2025-33053 Exploit via Malicious .URL File (Metasploit module)](https://www.rapid7.com/db/modules/exploit/windows/fileformat/unc_url_cve_2025_33053/)
- [Potential Exploitation of RCE Vulnerability CVE-2025-33053 (Sigma rule)](https://detection.fyi/sigmahq/sigma/emerging-threats/2025/exploits/cve-2025-33053/proc_creation_win_exploit_cve_2025_33053/)
- [CVE-2025-33053 GitHub Security Advisory](https://github.com/advisories/GHSA-26qv-p8cr-jxp5)
- [CVE-2025-33053 MSRC Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053)
- [Inside the Fix: Analysis of In-the-Wild Exploit of CVE-2026-21513](https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis)
- [APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday](https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html)
- [Russia-linked APT28 exploited MSHTML zero-day CVE-2026-21513](https://securityaffairs.com/188782/security/russia-linked-apt28-exploited-mshtml-zero-day-cve-2026-21513-before-patch.html)
- [CVE-2026-21513 MSRC Advisory](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21513)
- [CVE-2025-24054, NTLM Exploit in the Wild](https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1566