Rapid7 recovered 1,048 files from an exposed malware delivery server, uncovering an industrial-scale phishing operation targeting Mexican CURP users that integrates large language models into the threat production chain. The discovery, documented by The Hacker News on July 20, 2026 with technical analysis from the Rapid7 team, shows criminals operating with agile development methodologies: automated code review, vulnerability backlogs, and auto-generated documentation. The target is the Mexican government's CURP service, with a precise typosquat and an active campaign that logged over 77,000 requests in just over five days.
- Rapid7 recovered 1,048 artifacts from an exposed malware delivery server, including lure templates, systematic test kits, and documentation generated with large language models
- The primary technique exploits CVE-2025-33053 (CVSS 8.8, CISA KEV) to hijack the working directory of signed Windows binaries toward attacker-controlled WebDAV shares
- The operator tested 59 .url file variants against alternative binaries after iediagcmd.exe failed on Windows 11 24H2, demonstrating structured iteration
- From June 20–26, 2026 UTC, the delivery panel logged 77,098 requests from 3,892 unique IPs across 101 countries, with 82.5% of traffic and 96.9% of launch activity originating from Mexico
The Attacker's Bug Report: When Crime Mimics Software Engineering
The exposed server was not a random repository. Rapid7 describes it as an organized delivery lab across ten functional categories: 453 LNK files, 236 filename spoofing tests, 147 URL and LOLBin experiments, 89 encrypted droppers. At the toolkit's core sits a README that precisely replicates the path summerartcamp[.]net@ssl@443\DavWWWRoot\OSYxaOjr from Check Point's original report on CVE-2025-33053, with the operator's note: "WITHOUT any security warnings. Zero alerts!".
The documentary structure convinced Rapid7 to characterize the operation as a "modern software product team": templated sections, systematic emojis, verbosity characteristic of large language models. The toolkit explicitly references Coderrr/CodeRRR, a generic open-source coding agent not specific to attacks, indicating the adopted tools come from the mainstream AI ecosystem.
The exposed workflow includes two parallel campaign chains, build notes, a lure builder, and a delivery panel dubbed "Simba Service" left on default port and credentials. The accidental exposure allowed researchers to observe not just the final product, but the quality assurance process that produced it—a rare opportunity in threat intelligence, where one typically analyzes static artifacts devoid of development context.
From iediagcmd.exe to 59 Candidates: Post-IE Adaptation
The toolkit's central technique exploits CVE-2025-33053, a working directory hijack vulnerability in Windows that Microsoft patched in June 2025 and CISA added to the KEV catalog with two associated dates, January 7 and June 10, 2025. The vector uses .url files pointing to attacker-controlled WebDAV shares: when a signed Windows binary resolves child process names, it searches the hijacked working directory first instead of System32, executing malicious code with the legitimate signature as context.
Check Point's original report had identified iediagcmd.exe as the vulnerable binary. In the exposed toolkit, the operator documents the failure on Windows 11 24H2 with the note: "Win11 24H2 (IE removed): NO (this is why your F-series failed!)". This finding triggered a methodical expansion: 59 .url files dedicated to alternative binaries, including InstallUtil, RegAsm, LOLBAS utilities, and UAC bypass candidates, each with a _MAPPING.csv file associating tests with target executable and written theory of the presumed vulnerability.
Not all 59 candidates represent verified exploits: they are tests in progress, not confirmations. But the scale of systematicity signals a qualitative shift in attack preparation, where the removal of a system component (Internet Explorer) triggers not campaign abandonment, but a structured search for substitutes.
The Mexican Campaign: Numbers, Geolocation, and Social Engineering
The delivery domain, gobf[.]mx, is a typosquat of the Mexican government portal for the Unique Population Registry Code (CURP). The primary lure is an .scr file with an RLO (Right-to-Left Override, U+202E) character that visually appears as a PDF, distributed via search-ms: queries that open the WebDAV share in an Explorer search window filtered for .scr extensions.
Delivery panel logs, active June 20–26, 2026 UTC, show sharp geographic concentration: 82.5% of total traffic and 96.9% of launch activity originate from Mexico. The single CURP lure generated 2,384 launch events out of 2,441 total (97.7%). Activity clusters during Mexican business hours, a pattern Rapid7 says suggests real users rather than automated scanners.
"the attacker used LLMs to operate more like a modern software product team" — Rapid7, reported by The Hacker News
Rapid7 explicitly notes that "launch event" indicates a client request or opening of the executable from the share, measured by the delivery panel—not confirmed infection: the team lacks visibility into endpoints actually compromised. The data remains significant for the campaign's intentionality and targeting.
What to Do Now
- Check for DNS requests or connections to domains with the
*.net@ssl@pattern or anomalous WebDAV paths in user browsing, a behavioral indicator associated with the CVE-2025-33053 technique - Monitor execution of signed Windows binaries from non-standard paths, particularly remote working directories, since the attack chain depends on child process resolution in the hijacked working folder
- Watch traffic to newly registered domains with visual similarity to national government services, given the CURP typosquat demonstrates attention to geolocation and institutional context
- Review policies for handling .url files and
search-ms:queries in email and collaboration channels, as both vectors are documented in the exposed toolkit
From Rapid7 to Check Point: Confirmation and Threat Landscape Context
Check Point's threat intelligence report of July 27, 2026 concisely confirms the operation as a "generative AI-assisted malware operation exposed through accessible WebDAV server," with over 77,000 requests and more than 1,000 artifacts. The convergence between the two primary sources—Rapid7 with direct technical analysis and Check Point with validation in its intelligence report—strengthens the data's solidity without introducing new operational details.
The exposed toolkit also includes minor tests for CVE-2026-21513 (MSHTML bypass) and CVE-2025-24054 (NTLM leak, CVSS 6.5), but these remain small-scale compared to the primary WebDAV chain. No infrastructure overlaps emerge linking the operator to known APT groups at this stage: folder names suggest a Russian-language context, but do not constitute attribution.
Malware Industrialization and the Reproducibility Problem
The most disturbing element of the discovery is not individual technical sophistication, but its reproducibility. CVE-2025-33053 has been patched for over a year; the combination with WebDAV, signed binaries, and RTLO lures does not represent innovation at the component level. What changes is the packaging: LLM-assisted documentation, structured QA, vulnerability backlogs, sprint methodology.
This model lowers the technical skill barrier for orchestrating targeted phishing campaigns with government targeting. The AI tools adopted are generic and open-source, not specialized criminal products: their public availability means analogous operators can emerge rapidly without depending on proprietary development infrastructure.
For defenders, the accidental exposure offers rare insight into the adversary workflow: visibility into the test process, documented failures, and subsequent iterations. But this visibility is an exceptional event, not a reproducible strategy. The norm remains post-facto analysis of compact artifacts, stripped of the development history that in this case illuminated the methodology.
Frequently Asked Questions
What is a "launch event" and why doesn't it equal confirmed infection?
According to Rapid7, the term indicates a client request or opening of the executable from the WebDAV share, measured by the delivery panel. It does not imply the payload bypassed local security controls or that malicious execution completed on the final device.
Why did the operator fail on Windows 11 24H2?
Microsoft removed Internet Explorer in that version; iediagcmd.exe, the binary central to the original exploit chain, is no longer available. The operator documented the failure and initiated tests on 59 alternative binaries, demonstrating structured adaptation.
What kind of AI tool is Coderrr/CodeRRR?
It is a generic open-source coding agent, not specific to attacks or security. Its presence in the toolkit indicates the operator integrated mainstream AI ecosystem tools into the malware production workflow, not that they developed or purchased a dedicated criminal product.
Sources
- https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html
- https://www.pentagondesign.com/news/exposed-server-reveals-ai-assisted-phishing-toolkit-behind-webdav-malware-campaign/
- https://news.cybertechworld.co.in/index.php/2026/07/20/exposed-server-reveals-ai-assisted-phishing-toolkit-behind-webdav-malware-campaign/
- https://research.checkpoint.com/2026/27th-july-threat-intelligence-report/
- https://nvd.nist.gov/vuln/detail/CVE-2025-33053
- https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/
- https://thehackernews.com/2025/06/microsoft-patches-67-vulnerabilities.html
- https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html
Information verified against cited sources and current as of publication.