HOW AN ATTACKER'S BLUNDER GAVE US A RARE LOOK INSIDE THEIR DAY-TO-DAY OPERATIONS

Summary from the TLDR InfoSec newsletter

Huntress gained unprecedented insight into a threat actor's operations when the attacker accidentally installed their EDR agent after finding them through a Google ad while researching Bitdefender, revealing extensive use of AI tools like Make.com for workflow automation, searches for Evilginx instances, and systematic reconnaissance targeting Nigerian banks and cryptocurrency exchanges. The actor demonstrated sophisticated OPSEC with residential proxies (LunaProxy), anti-detection browsers (Nstbrowser), and security tools (Malwarebytes) while working 12 to 14-hour days conducting research, crafting phishing messages using Google Translate, and accessing over 2,400 compromised identities. Browser history revealed their evolution from manual processes to AI-assisted workflows, including automated Telegram bot integration and the use of stolen cookies with tools like ROADtools for Microsoft Entra token exploitation.