diff --git a/content/posts/operation-talked-apt-vs-homelab.md b/content/posts/operation-talked-apt-vs-homelab.md new file mode 100644 index 0000000..92150aa --- /dev/null +++ b/content/posts/operation-talked-apt-vs-homelab.md @@ -0,0 +1,139 @@ +--- +title: "Operation Talked: Russia-Nexus APT vs a Homelab Pentest Pipeline — Same Tools, Different Discipline" +date: 2026-07-31T20:00:00+00:00 +draft: false +tags: ["threat-intelligence", "cybersecurity", "infosec", "homelab", "docker-swarm", "selfhosted", "build-in-public", "apprendre-la-cyber", "osint"] +summary: "SOCRadar exposed an active Russian espionage campaign targeting Ukraine's defense sector. Their C2 stack? Almost identical to my homelab. Here's the full comparison." +description: "Operation Talked used Sliver, WireGuard, 3x-ui and masscan — the same open-source stack as my automated pentest pipeline. The difference wasn't the tools, it was operational discipline." +author: "Bojemoi" +ShowToc: true +ShowReadingTime: true +--- + +SOCRadar just published a detailed teardown of **Operation Talked**, a 14-month Russia-linked espionage campaign (attributed to UAC-0056/UAC-0114) that breached 9 Ukrainian defense and aerospace contractors, stealing full Git repository dumps. The campaign was still active at publication (July 29, 2026), with an interactive shell open on a Ukrainian railway logistics operator. + +What caught my attention: their C2 stack is almost identical to what I run in my automated pentest pipeline. + +--- + +## The Toolset Comparison + +| Tool | Operation Talked | Bojemoi Lab | +|------|-----------------|-------------| +| C2 framework | Sliver mTLS + HTTP (v1.5.x) | Sliver mTLS + HTTP | +| VPN | WireGuard (port 44444/UDP) | WireGuard | +| VPN panel | 3x-ui MHSanaei fork (port 55555) | 3x-ui MHSanaei fork | +| Mass scanner | masscan + fscan | masscan (automated, 15 replicas) | +| Vuln scanner | nuclei | nuclei-worker (automated queue) | +| AI tooling | Kimi AI (kimi-cli) | Claude Haiku | +| Orchestration | manual (hands-on-keyboard) | fully automated pipeline | + +These are literally the same open-source tools. The offensive ecosystem has completely democratized the toolset — a state-sponsored actor and a homelab run the same stack. + +--- + +## Where They Win: Post-Exploitation Windows AD + +Their real advantage is in the post-exploitation phase, specifically Active Directory: + +- **mimikatz** — LSASS memory dump (T1003.001) +- **DonPAPI** — DPAPI credential harvest (T1555.003) +- **NetExec** — Pass-the-Hash via `nxc smb -H` (T1550.002) +- **Kerberos ticket theft** — Pass-the-Ticket (T1550.003) +- **evil-winrm** — WinRM lateral movement (T1021.006) +- **git-dumper** — bulk Git repository exfiltration (T1213) +- **proxychains-ng across 80+ proxies** — multi-hop exfil (T1090.003) + +My pipeline is Linux/web focused. No AD lateral movement module. This is the genuine gap. + +--- + +## Where I Win: OPSEC and Automation + +### OPSEC + +This is where the comparison becomes almost comical. + +They ran everything on a bare Yandex Cloud IP (AS13238, Moscow) with zero reverse proxy. One service was a raw `python3 -m http.server` listener on port 8090 — serving 8,436 operational files with no authentication. Tools, stolen credentials, target lists, Sliver session logs, WireGuard private keys — all publicly accessible. + +That single misconfiguration gave SOCRadar a 14-month case file built entirely from the attacker's own perspective. + +My setup: +- Traefik reverse proxy in front of every service +- Fly.io redirectors — C2 traffic never hits the real server IP +- Docker secrets for all credentials +- Prometheus alerts on unexpected inbound connections + +I would have detected an unauthorized reader on my infrastructure within minutes. They didn't notice for weeks. + +The attribution tells the same story: their bash history contained commands mistyped with their Russian JCUKEN keyboard layout (`cd` typed as `св`, `ls` as `ды`). A VPN cannot mask muscle memory. + +### Automation + +They worked manually, hands-on-keyboard. My pipeline runs continuously without intervention: + +``` +AK47 (masscan) → BM12 (fingerprinting) → UZI (MSF exploitation) + → Sliver implant deploy + → ZAP (web scan) + → nuclei (CVE detection) + → DefectDojo (triage via Claude Haiku) + → Telegram alerts +``` + +15 scanning replicas, automated exploit queues, AI-powered triage. They had an operator manually enumerating databases on a compromised server. I have a queue processor. + +--- + +## Full MITRE ATT&CK Coverage + +Their complete TTP map across the 14-month campaign: + +| Tactic | Technique | Tool | +|--------|-----------|------| +| Reconnaissance | T1595.001 Active Scanning | masscan, fscan, nuclei, Netlas/Shodan/FOFA | +| Resource Dev | T1583.003 VPS | Yandex Cloud Moscow | +| Initial Access | T1190 Exploit Public-Facing App | 19 CVEs (Sophos XG, FortiOS, F5, SAP, WordPress...) | +| Initial Access | T1133 External Remote Services | FortiGate SSL-VPN credential reuse | +| Persistence | T1505.003 Web Shell | Godzilla ASPX, r57, suo5 | +| Persistence | T1133 Sliver beacon | 60-second mTLS check-in | +| Defense Evasion | T1573.001 Encrypted Channel | Sliver mTLS | +| Credential Access | T1003.001 LSASS | mimikatz | +| Credential Access | T1555.003 Web Credentials | DonPAPI | +| Discovery | T1087.002 Domain Account | powerview.py, LDAP | +| Lateral Movement | T1550.002 Pass the Hash | NetExec | +| Lateral Movement | T1550.003 Pass the Ticket | Kerberos | +| Lateral Movement | T1021.006 WinRM | evil-winrm | +| Collection | T1213 Information Repositories | git-dumper | +| Exfiltration | T1567.002 Cloud Storage | AWS S3 | +| C2 | T1090.003 Multi-hop Proxy | proxychains-ng, Chisel, Gost SOCKS5 | + +My pipeline covers T1595 through T1573. Everything from T1003 onward is the gap. + +--- + +## Key CVEs in Their Arsenal + +- **CVE-2022-1040** — Sophos XG RCE (757,000 targets scanned) +- **CVE-2024-55591** — FortiOS auth bypass +- **CVE-2025-31324** — SAP NetWeaver deserialization RCE +- **CVE-2023-46747** — F5 BIG-IP unauth RCE +- **CVE-2026-63030** — WordPress wp2shell (very recent) +- **CVE-2025-49113 / CVE-2025-25257** — Roundcube RCE + +All 6 have Nuclei templates in my pipeline's template library. + +--- + +## The Takeaway + +State-sponsored actors with significant resources are running the same open-source offensive toolstack as a homelab. The sophistication gap isn't in the tools — it's in operational discipline and automation. + +They had better post-exploitation depth (Windows AD). I have better OPSEC and full automation. They got caught because of a `SimpleHTTP` server left running on their C2. + +The democratization of offensive tooling is real. What differentiates operators isn't access to exotic tools — it's how they run them. + +--- + +*Source: [SOCRadar — Operation Talked, July 29 2026](https://socradar.io/blog/operation-talked-russia-ukraine-defense-industry/)* +*MITRE ATT&CK Navigator layer available in the [bojemoi CTI repo](https://gitea.bojemoi.me/bojemoi/bojemoi)*