💥 BREACHES & INCIDENTS
- Operation Master: Hackers Exploit GlobalProtect Flaw, Turn Stolen Data Into 2.4M Fraud Messages
SOCRadar uncovered Operation Master, a campaign exploiting a GlobalProtect authentication bypass to steal customer records and fuel a large-scale invoice fraud operation targeting Brazilian customers.- Targets businesses in four countries, mainly Brazilian utility customers, via seven GlobalProtect VPN gateways and at least nine database systems, April to mid-September 2026.
- Attackers exploited CVE-2026-0257, a GlobalProtect authentication bypass, to create VPN sessions without valid credentials after scanning hundreds of millions of addresses.
- Automated SQL injection extracted records — one theft yielded 24,558 debtor records — with data exfiltrated via structured DNS requests and AdaptixC2 used to control Windows servers.
- A fraud panel sent 2.47M emails and 1.49M SMS using ~12 hijacked Microsoft 365 mailboxes and eight SMS gateways, generating 622,666 personalized short links and 317,696 clicks.
- Logged invoice values totaled R$150.4 million (R$38.9 million clicked); IOCs include domains yzs[.]fi and igreenfaturas[.]to and IPs 91[.]92[.]241[.]187 and 185[.]242[.]3[.]14.
Sources 📄 Source: socradar.io · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)