bojemoi
b236120978
6.6 KiB
title, date, draft, tags, summary, description, author, ShowToc, ShowReadingTime
| title | date | draft | tags | summary | description | author | ShowToc | ShowReadingTime | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Operation Talked: Russia-Nexus APT vs a Homelab Pentest Pipeline — Same Tools, Different Discipline | 2026-07-31T20:00:00+00:00 | false |
|
SOCRadar exposed an active Russian espionage campaign targeting Ukraine's defense sector. Their C2 stack? Almost identical to my homelab. Here's the full comparison. | Operation Talked used Sliver, WireGuard, 3x-ui and masscan — the same open-source stack as my automated pentest pipeline. The difference wasn't the tools, it was operational discipline. | Bojemoi | true | true |
SOCRadar just published a detailed teardown of Operation Talked, a 14-month Russia-linked espionage campaign (attributed to UAC-0056/UAC-0114) that breached 9 Ukrainian defense and aerospace contractors, stealing full Git repository dumps. The campaign was still active at publication (July 29, 2026), with an interactive shell open on a Ukrainian railway logistics operator.
What caught my attention: their C2 stack is almost identical to what I run in my automated pentest pipeline.
The Toolset Comparison
| Tool | Operation Talked | Bojemoi Lab |
|---|---|---|
| C2 framework | Sliver mTLS + HTTP (v1.5.x) | Sliver mTLS + HTTP |
| VPN | WireGuard (port 44444/UDP) | WireGuard |
| VPN panel | 3x-ui MHSanaei fork (port 55555) | 3x-ui MHSanaei fork |
| Mass scanner | masscan + fscan | masscan (automated, 15 replicas) |
| Vuln scanner | nuclei | nuclei-worker (automated queue) |
| AI tooling | Kimi AI (kimi-cli) | Claude Haiku |
| Orchestration | manual (hands-on-keyboard) | fully automated pipeline |
These are literally the same open-source tools. The offensive ecosystem has completely democratized the toolset — a state-sponsored actor and a homelab run the same stack.
Where They Win: Post-Exploitation Windows AD
Their real advantage is in the post-exploitation phase, specifically Active Directory:
- mimikatz — LSASS memory dump (T1003.001)
- DonPAPI — DPAPI credential harvest (T1555.003)
- NetExec — Pass-the-Hash via
nxc smb -H(T1550.002) - Kerberos ticket theft — Pass-the-Ticket (T1550.003)
- evil-winrm — WinRM lateral movement (T1021.006)
- git-dumper — bulk Git repository exfiltration (T1213)
- proxychains-ng across 80+ proxies — multi-hop exfil (T1090.003)
My pipeline is Linux/web focused. No AD lateral movement module. This is the genuine gap.
Where I Win: OPSEC and Automation
OPSEC
This is where the comparison becomes almost comical.
They ran everything on a bare Yandex Cloud IP (AS13238, Moscow) with zero reverse proxy. One service was a raw python3 -m http.server listener on port 8090 — serving 8,436 operational files with no authentication. Tools, stolen credentials, target lists, Sliver session logs, WireGuard private keys — all publicly accessible.
That single misconfiguration gave SOCRadar a 14-month case file built entirely from the attacker's own perspective.
My setup:
- Traefik reverse proxy in front of every service
- Fly.io redirectors — C2 traffic never hits the real server IP
- Docker secrets for all credentials
- Prometheus alerts on unexpected inbound connections
I would have detected an unauthorized reader on my infrastructure within minutes. They didn't notice for weeks.
The attribution tells the same story: their bash history contained commands mistyped with their Russian JCUKEN keyboard layout (cd typed as св, ls as ды). A VPN cannot mask muscle memory.
Automation
They worked manually, hands-on-keyboard. My pipeline runs continuously without intervention:
AK47 (masscan) → BM12 (fingerprinting) → UZI (MSF exploitation)
→ Sliver implant deploy
→ ZAP (web scan)
→ nuclei (CVE detection)
→ DefectDojo (triage via Claude Haiku)
→ Telegram alerts
15 scanning replicas, automated exploit queues, AI-powered triage. They had an operator manually enumerating databases on a compromised server. I have a queue processor.
Full MITRE ATT&CK Coverage
Their complete TTP map across the 14-month campaign:
| Tactic | Technique | Tool |
|---|---|---|
| Reconnaissance | T1595.001 Active Scanning | masscan, fscan, nuclei, Netlas/Shodan/FOFA |
| Resource Dev | T1583.003 VPS | Yandex Cloud Moscow |
| Initial Access | T1190 Exploit Public-Facing App | 19 CVEs (Sophos XG, FortiOS, F5, SAP, WordPress...) |
| Initial Access | T1133 External Remote Services | FortiGate SSL-VPN credential reuse |
| Persistence | T1505.003 Web Shell | Godzilla ASPX, r57, suo5 |
| Persistence | T1133 Sliver beacon | 60-second mTLS check-in |
| Defense Evasion | T1573.001 Encrypted Channel | Sliver mTLS |
| Credential Access | T1003.001 LSASS | mimikatz |
| Credential Access | T1555.003 Web Credentials | DonPAPI |
| Discovery | T1087.002 Domain Account | powerview.py, LDAP |
| Lateral Movement | T1550.002 Pass the Hash | NetExec |
| Lateral Movement | T1550.003 Pass the Ticket | Kerberos |
| Lateral Movement | T1021.006 WinRM | evil-winrm |
| Collection | T1213 Information Repositories | git-dumper |
| Exfiltration | T1567.002 Cloud Storage | AWS S3 |
| C2 | T1090.003 Multi-hop Proxy | proxychains-ng, Chisel, Gost SOCKS5 |
My pipeline covers T1595 through T1573. Everything from T1003 onward is the gap.
Key CVEs in Their Arsenal
- CVE-2022-1040 — Sophos XG RCE (757,000 targets scanned)
- CVE-2024-55591 — FortiOS auth bypass
- CVE-2025-31324 — SAP NetWeaver deserialization RCE
- CVE-2023-46747 — F5 BIG-IP unauth RCE
- CVE-2026-63030 — WordPress wp2shell (very recent)
- CVE-2025-49113 / CVE-2025-25257 — Roundcube RCE
All 6 have Nuclei templates in my pipeline's template library.
The Takeaway
State-sponsored actors with significant resources are running the same open-source offensive toolstack as a homelab. The sophistication gap isn't in the tools — it's in operational discipline and automation.
They had better post-exploitation depth (Windows AD). I have better OPSEC and full automation. They got caught because of a SimpleHTTP server left running on their C2.
The democratization of offensive tooling is real. What differentiates operators isn't access to exotic tools — it's how they run them.
Source: SOCRadar — Operation Talked, July 29 2026
MITRE ATT&CK Navigator layer available in the bojemoi CTI repo