Zeta-9 Security Incident Report

On September 16, 2025, the adversary identified Zeta-9's FortiGate Firewall exposed to the internet via its public IP address. The attacker's originating IP was recorded as 38[.]68[.]134[.]103.

Shortly afterward, the firewall logs captured evidence of an unauthorized administrator login performed through the FortiGate JSON console interface (jsconsole), which corresponds to the authentication bypass vulnerability CVE-2024-55591.

These events indicate that the attacker exploited the vulnerability to execute API calls locally via 127.0.0.1, bypassing normal authentication controls and logging in as the administrator account "ghost." Immediately after gaining administrative access, the attacker modified a user group (ZetaGroup) to include several new VPN accounts, establishing a persistent entry point into the internal network.

The adversary then leveraged these newly added credentials to initiate a VPN connection and access Zeta-9's internal environment without triggering perimeter authentication alerts. The adversary now had access to the internal network with an IP address of 10[.]1[.]1[.]10.

Once inside, the adversary conducted network reconnaissance within the 192.168.86.0/24 subnet, scanning for SMB (445/TCP), RPC/DCOM (135/TCP), and LDAP (389/TCP) services: typical indicators of host and domain enumeration activity.

This reconnaissance revealed the presence of a JUMPHOST system, which subsequently became the next stage of the attacker's lateral movement.

Another activity was observed on September 24, 2025. The adversary with an IP address of 91[.]90[.]124[.]21 had interacted with the Surveillance Storage Console.

The adversary attempted to conduct a SQL injection attack on the Surveillance Storage Console.

The adversary successfully exploited the SQL injection vulnerability on the Surveillance Storage Console and was able to download the storage object with an ID of 6.

The user-agent showed that the threat actor used PowerShell to manually exploit the SQL injection vulnerability and download storage object ID 6, which is the cam06_ai_monitor_securityincident.mp4 video file.

The credential of operator39 could be obtained within the video, which would be used for lateral movement to JUMPBOX.

With the credential obtained from the Surveillance Storage Console, the adversary conducted a WMI-based lateral movement technique to inject a malicious DLL into the legitimate more.com process.

The adversary deployed the custom malware (Deaddrop.dll) on this jumphost, which retrieved its configuration like the ChaCha20 key and nonce from the repository hosted on codeberg.org.

The custom malware exfiltrated data via dnshook[.]site by appending a subdomain with the BASE32-encoded ChaCha20-Poly1305 ciphertext.

The AWS credential was stolen and would be used to access the hybrid cloud environment.

Credentials exfiltrated from the jump box were used by the adversary to sign in to AWS as "VictorVenom." The activity was observed from 172[.]235[.]129[.]221 on September 25, 2025, in the AWS CloudTrail log.

After gaining access, the adversary invoked the GetSecretValue API to retrieve the secret zeta9/windows/admin-password, which likely contains Windows administrative credentials.

Subsequently, the adversary downloaded 5 objects from 3 different Amazon S3 buckets including a database backup, secret API key, threat analysis report, and the Zombie 15 experiment.

After that, the adversary activity was observed from the website hosted on Azure, which was restricted to administrator-level access only. The adversary used the cmd parameter to run system commands to request an OAuth access token from Azure Managed Identity using a secret that was possibly obtained from an AWS S3 object.

Using the acquired OAuth token, the adversary accessed the quantum-research-secrets Azure Blob Storage container and exfiltrated sensitive files including contracts, research, and confidential laboratory information.

The adversary was observed retrieving malicious content from hxxps[://]pastebin[.]com/raw/sBEs83q3, which was then used to overwrite /home/site/wwwroot/public/index.html. This action resulted in the defacement of the main index page of zeta9-research-portal.azurewebsites.net.

From the initial access to the AWS environment to website defacement, the adversary only took 44 minutes from 16:06:00 UTC to 16:50:00 UTC. This rapid attack sequence demonstrated sophisticated knowledge of both AWS and Azure environments, indicating a well-planned and executed intrusion.

On September 27, 2025, Dr. Frankenstein Code visited a compromised website that had been defaced by the adversary, which led to a FileFix attack being successfully deployed on this workstation.

Upon executing the malicious PowerShell command from the defaced website, the command fetched another PowerShell script payload from hxxps[://]gist[.]githubusercontent[.]com/a1l4m/.../Microsoft[.]PowerShell[.]DataV4Adapter[.]ps1 and this script fetched the hex-encoded shellcode from hxxps[://]gist[.]githubusercontent[.]com/a1l4m/.../IamTheDanger[.]txt and executed it, which established a reverse shell connection to the adversary on 35[.]158[.]153[.]237 on port 34651.

The first command after establishing the reverse shell connection was observed from the adversary at 11:18:33 with the whoami command to determine the level of access on this workstation. Subsequently, we observed more activity from the adversary, which utilized rclone to transfer the Sliver C2 implant from MEGA drive.

The Sliver C2 implant was originally named sapi.cpl as downloaded from MEGA drive.

The adversary then renamed it to RunTimeBroker.exe and moved it to C:\Users\Public.

The adversary achieved persistence on this workstation by creating a PowerShell profile, as observed in the USN Journal.

The Sliver C2 implant execution was observed several times after PowerShell execution. Afterward, KillTheCURE.exe and sdelete.exe were executed from the same folder at C:\Users\Dr.FrankensteinCode\AppData\Local\CureKiller\CureKiller around 15:49:58 ~ 15:49:59.

KillTheCURE.exe and sdelete.exe along with several DLLs were observed being extracted from the CUREKiller.zip file that was downloaded with the living-off-the-land binary certutil.exe, and the Exfiltration_data.zip was created after the execution of KillTheCURE.exe.

CUREKiller.zip was downloaded from GitHub. This attachment was likely uploaded within an issue, a pull request, or a comment on GitHub.

The adversary used sdelete to permanently delete all original files that had already been copied to the user's temporary folder.

SDelete.exe execution was observed immediately after the execution of KillTheCURE.exe, which deleted 6 files on the desktop:

• C:\Users\Dr.FrankensteinCode\Desktop\confidential.png
• C:\Users\Dr.FrankensteinCode\Desktop\CURE.txt
• C:\Users\Dr.FrankensteinCode\Desktop\gunman.png
• C:\Users\Dr.FrankensteinCode\Desktop\Helena.txt
• C:\Users\Dr.FrankensteinCode\Desktop\test.txt
• C:\Users\Dr.FrankensteinCode\Desktop\outbreak.png

After finishing the deletion, an image file was created with the Exfiltration_data.zip embedded, which contained the 6 files stolen from this workstation.

KillTheCURE.exe was designed to search for .png and .txt files located in the Downloads and Desktop folders of the current user and copy them to the Temp folder, zip them to Exfiltrated_data.zip, embed the archive in BetterCallSaul.png, send the image to 36[.]157[.]123[.]216 with an HTTP POST request, and finally use sdelete.exe to completely remove the original files from the workstation.

The adversary also utilized rclone as a fallback, and we successfully obtained the image file from the MEGA drive of the adversary.

After the exfiltration phase, the adversary cleared all tracks that could be traced back to them.

Additionally, a Wing FTP Server exploitation script (CVE-2025-47812) was also found on the MEGA drive and on this workstation, which indicates that the adversary also attempted to exploit the Wing FTP Server running on this workstation.

On September 28, 2025, the adversary cleared 5 different logs, and a netcat executable was also observed before the log clearing event.

The registry key that contains the information indicating the FileFix attack was deleted at 2025-09-28 02:20:47.

All of them were eventually deleted by the adversary at the end.