A Threat Actor Abuses Another Free Trial

What it is

Part 2 of Huntress's investigation into a threat actor who exfiltrated victim data to an attacker-owned Elastic Cloud SIEM free trial, following exploitation of SolarWinds Web Help Desk. The novel value here over the summary is the concrete infrastructure fingerprint and a pivot technique linking the actor's email registrations to their C2 hosting.

How it works

The victim ran an encoded PowerShell command with a hardcoded API key that piped Get-ComputerInfo output — OS version, hardware, Active Directory domain info, installed patches — into an attacker-controlled Elasticsearch index named systeminfo. The actor then used Kibana's Discover interface to triage multiple victims across the campaign, treating a commodity SIEM as their own analysis platform.

The key pivot: the actor's disposable-email prefix (an eight random lowercase-letter string on quieresmail[.]com) was reused as the subdomain of their Cloudflare Worker pages hosting Velociraptor callbacks — e.g. the prefix matching qgtxtebl.workers[.]dev. Email prefixes are random; Worker subdomains are configurable, so the match is deliberate: the random string functions as a shared identifier across the actor's registrations and tooling. This lets defenders correlate otherwise-disconnected infrastructure.

Preconditions / Affected

Relevant if you run SolarWinds Web Help Desk (or, per the page, possibly Microsoft SharePoint and other software hit in related opportunistic attacks) and could be a triage target. The actor's toolset spans Velociraptor, Cloudflare Workers, and a SAFING_VPN tunnel.

What to do

Hunt on the specific indicators the page discloses:

• Elastic Cloud deployment: created 2026-01-28 01:45 UTC, cloud account u_706752903_cloud, deployment ID 7c00a38569a8471083b6b34e1511b9de, Elasticsearch 9.2.4, GCP us-central1, default name "My deployment", Fleet agent healthy through Feb 7 (now taken down).
• Index name: watch for outbound writes to an ElasticSearch index named systeminfo.
• Email: quieresmail[.]com addresses — eight random lowercase letters, or fake first/last name plus a four-digit year — tied to the Russian-registered firstmail.ltd network (hundreds of throwaway domains).
• C2: Cloudflare *.workers[.]dev subdomains hosting Velociraptor callbacks; cross-reference the subdomain string against any observed disposable-email prefixes.
• Watch for encoded PowerShell invoking Get-ComputerInfo with a hardcoded API key exfiltrating to an external Elasticsearch endpoint.

Caveats

The specific deployment is already down, so its exact IDs are historical, not live — their value is retrospective log-matching and understanding the actor's naming pattern, not current blocking. The link to SharePoint and "other software" attacks is stated only as a "possible connection." The email-prefix-to-Worker-subdomain correlation is Huntress's inference from multiple matching instances, not a claim every registration follows the pattern.