post: Operation Talked — APT vs homelab comparison
All checks were successful
Hugo Build & Deploy / build-deploy (push) Successful in 5m4s
All checks were successful
Hugo Build & Deploy / build-deploy (push) Successful in 5m4s
This commit is contained in:
139
content/posts/operation-talked-apt-vs-homelab.md
Normal file
139
content/posts/operation-talked-apt-vs-homelab.md
Normal file
@@ -0,0 +1,139 @@
|
||||
---
|
||||
title: "Operation Talked: Russia-Nexus APT vs a Homelab Pentest Pipeline — Same Tools, Different Discipline"
|
||||
date: 2026-07-31T20:00:00+00:00
|
||||
draft: false
|
||||
tags: ["threat-intelligence", "cybersecurity", "infosec", "homelab", "docker-swarm", "selfhosted", "build-in-public", "apprendre-la-cyber", "osint"]
|
||||
summary: "SOCRadar exposed an active Russian espionage campaign targeting Ukraine's defense sector. Their C2 stack? Almost identical to my homelab. Here's the full comparison."
|
||||
description: "Operation Talked used Sliver, WireGuard, 3x-ui and masscan — the same open-source stack as my automated pentest pipeline. The difference wasn't the tools, it was operational discipline."
|
||||
author: "Bojemoi"
|
||||
ShowToc: true
|
||||
ShowReadingTime: true
|
||||
---
|
||||
|
||||
SOCRadar just published a detailed teardown of **Operation Talked**, a 14-month Russia-linked espionage campaign (attributed to UAC-0056/UAC-0114) that breached 9 Ukrainian defense and aerospace contractors, stealing full Git repository dumps. The campaign was still active at publication (July 29, 2026), with an interactive shell open on a Ukrainian railway logistics operator.
|
||||
|
||||
What caught my attention: their C2 stack is almost identical to what I run in my automated pentest pipeline.
|
||||
|
||||
---
|
||||
|
||||
## The Toolset Comparison
|
||||
|
||||
| Tool | Operation Talked | Bojemoi Lab |
|
||||
|------|-----------------|-------------|
|
||||
| C2 framework | Sliver mTLS + HTTP (v1.5.x) | Sliver mTLS + HTTP |
|
||||
| VPN | WireGuard (port 44444/UDP) | WireGuard |
|
||||
| VPN panel | 3x-ui MHSanaei fork (port 55555) | 3x-ui MHSanaei fork |
|
||||
| Mass scanner | masscan + fscan | masscan (automated, 15 replicas) |
|
||||
| Vuln scanner | nuclei | nuclei-worker (automated queue) |
|
||||
| AI tooling | Kimi AI (kimi-cli) | Claude Haiku |
|
||||
| Orchestration | manual (hands-on-keyboard) | fully automated pipeline |
|
||||
|
||||
These are literally the same open-source tools. The offensive ecosystem has completely democratized the toolset — a state-sponsored actor and a homelab run the same stack.
|
||||
|
||||
---
|
||||
|
||||
## Where They Win: Post-Exploitation Windows AD
|
||||
|
||||
Their real advantage is in the post-exploitation phase, specifically Active Directory:
|
||||
|
||||
- **mimikatz** — LSASS memory dump (T1003.001)
|
||||
- **DonPAPI** — DPAPI credential harvest (T1555.003)
|
||||
- **NetExec** — Pass-the-Hash via `nxc smb -H` (T1550.002)
|
||||
- **Kerberos ticket theft** — Pass-the-Ticket (T1550.003)
|
||||
- **evil-winrm** — WinRM lateral movement (T1021.006)
|
||||
- **git-dumper** — bulk Git repository exfiltration (T1213)
|
||||
- **proxychains-ng across 80+ proxies** — multi-hop exfil (T1090.003)
|
||||
|
||||
My pipeline is Linux/web focused. No AD lateral movement module. This is the genuine gap.
|
||||
|
||||
---
|
||||
|
||||
## Where I Win: OPSEC and Automation
|
||||
|
||||
### OPSEC
|
||||
|
||||
This is where the comparison becomes almost comical.
|
||||
|
||||
They ran everything on a bare Yandex Cloud IP (AS13238, Moscow) with zero reverse proxy. One service was a raw `python3 -m http.server` listener on port 8090 — serving 8,436 operational files with no authentication. Tools, stolen credentials, target lists, Sliver session logs, WireGuard private keys — all publicly accessible.
|
||||
|
||||
That single misconfiguration gave SOCRadar a 14-month case file built entirely from the attacker's own perspective.
|
||||
|
||||
My setup:
|
||||
- Traefik reverse proxy in front of every service
|
||||
- Fly.io redirectors — C2 traffic never hits the real server IP
|
||||
- Docker secrets for all credentials
|
||||
- Prometheus alerts on unexpected inbound connections
|
||||
|
||||
I would have detected an unauthorized reader on my infrastructure within minutes. They didn't notice for weeks.
|
||||
|
||||
The attribution tells the same story: their bash history contained commands mistyped with their Russian JCUKEN keyboard layout (`cd` typed as `св`, `ls` as `ды`). A VPN cannot mask muscle memory.
|
||||
|
||||
### Automation
|
||||
|
||||
They worked manually, hands-on-keyboard. My pipeline runs continuously without intervention:
|
||||
|
||||
```
|
||||
AK47 (masscan) → BM12 (fingerprinting) → UZI (MSF exploitation)
|
||||
→ Sliver implant deploy
|
||||
→ ZAP (web scan)
|
||||
→ nuclei (CVE detection)
|
||||
→ DefectDojo (triage via Claude Haiku)
|
||||
→ Telegram alerts
|
||||
```
|
||||
|
||||
15 scanning replicas, automated exploit queues, AI-powered triage. They had an operator manually enumerating databases on a compromised server. I have a queue processor.
|
||||
|
||||
---
|
||||
|
||||
## Full MITRE ATT&CK Coverage
|
||||
|
||||
Their complete TTP map across the 14-month campaign:
|
||||
|
||||
| Tactic | Technique | Tool |
|
||||
|--------|-----------|------|
|
||||
| Reconnaissance | T1595.001 Active Scanning | masscan, fscan, nuclei, Netlas/Shodan/FOFA |
|
||||
| Resource Dev | T1583.003 VPS | Yandex Cloud Moscow |
|
||||
| Initial Access | T1190 Exploit Public-Facing App | 19 CVEs (Sophos XG, FortiOS, F5, SAP, WordPress...) |
|
||||
| Initial Access | T1133 External Remote Services | FortiGate SSL-VPN credential reuse |
|
||||
| Persistence | T1505.003 Web Shell | Godzilla ASPX, r57, suo5 |
|
||||
| Persistence | T1133 Sliver beacon | 60-second mTLS check-in |
|
||||
| Defense Evasion | T1573.001 Encrypted Channel | Sliver mTLS |
|
||||
| Credential Access | T1003.001 LSASS | mimikatz |
|
||||
| Credential Access | T1555.003 Web Credentials | DonPAPI |
|
||||
| Discovery | T1087.002 Domain Account | powerview.py, LDAP |
|
||||
| Lateral Movement | T1550.002 Pass the Hash | NetExec |
|
||||
| Lateral Movement | T1550.003 Pass the Ticket | Kerberos |
|
||||
| Lateral Movement | T1021.006 WinRM | evil-winrm |
|
||||
| Collection | T1213 Information Repositories | git-dumper |
|
||||
| Exfiltration | T1567.002 Cloud Storage | AWS S3 |
|
||||
| C2 | T1090.003 Multi-hop Proxy | proxychains-ng, Chisel, Gost SOCKS5 |
|
||||
|
||||
My pipeline covers T1595 through T1573. Everything from T1003 onward is the gap.
|
||||
|
||||
---
|
||||
|
||||
## Key CVEs in Their Arsenal
|
||||
|
||||
- **CVE-2022-1040** — Sophos XG RCE (757,000 targets scanned)
|
||||
- **CVE-2024-55591** — FortiOS auth bypass
|
||||
- **CVE-2025-31324** — SAP NetWeaver deserialization RCE
|
||||
- **CVE-2023-46747** — F5 BIG-IP unauth RCE
|
||||
- **CVE-2026-63030** — WordPress wp2shell (very recent)
|
||||
- **CVE-2025-49113 / CVE-2025-25257** — Roundcube RCE
|
||||
|
||||
All 6 have Nuclei templates in my pipeline's template library.
|
||||
|
||||
---
|
||||
|
||||
## The Takeaway
|
||||
|
||||
State-sponsored actors with significant resources are running the same open-source offensive toolstack as a homelab. The sophistication gap isn't in the tools — it's in operational discipline and automation.
|
||||
|
||||
They had better post-exploitation depth (Windows AD). I have better OPSEC and full automation. They got caught because of a `SimpleHTTP` server left running on their C2.
|
||||
|
||||
The democratization of offensive tooling is real. What differentiates operators isn't access to exotic tools — it's how they run them.
|
||||
|
||||
---
|
||||
|
||||
*Source: [SOCRadar — Operation Talked, July 29 2026](https://socradar.io/blog/operation-talked-russia-ukraine-defense-industry/)*
|
||||
*MITRE ATT&CK Navigator layer available in the [bojemoi CTI repo](https://gitea.bojemoi.me/bojemoi/bojemoi)*
|
||||
Reference in New Issue
Block a user