Skip to content

Back to the catalog

The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
huntress.comwriteup

The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed

Huntress SOC incident report on an internet-facing RD Gateway/RDWeb terminal server compromised via credential reuse with no MFA, where the actor staged Gammadyne Mailer (a legitimate commercial bulk-mail tool) to send 8.9 million Boots-impersonation phishing emails direct-to-MX from the victim's clean IP, evading AV entirely. The phishing kit itself was hosted on a compromised Bolivian government domain (ipelc.gob.bo) to inherit its trust and dodge reputation blocklists, and the writeup details the log-forensics (Windows Security log gaps, Terminal Services operational logs, Chainsaw parsing, WFP Event 5157) used to reconstruct the timeline and attribute a separate opportunistic brute-force bot.

TL;DR Huntress traces an RDWeb/RD Gateway breach where attackers used a legit bulk-mailer to blast 8.9M Boots-phishing emails via direct-to-MX from a hacked terminal server, hosting the kit on a compromised Bolivian government site.
Open original ↗
Document

What it is

A Huntress SOC writeup of a mid-incident onboarding (25-endpoint client, agent installed 2026-05-15 18:48 UTC) where an internet-exposed RD Session Host — running RDWeb Access on IIS and the RD Gateway role on one box — had a single published domain account compromised. The value beyond the summary is the specific triage method for separating an automated credential-stuffing hit from hands-on-keyboard operator logins, and a counterintuitive detail: the four "successful" logins came from three IPs, and one of the three was a bot that found the password and then did nothing with it.

How it works

On IIS RDWeb forms auth, a failed login re-renders with HTTP 200; a success redirects with 302. Of 206,444 login POSTs, exactly four returned 302. The two operator IPs (80.94.95[.]37, a flagged Timisoara hosting address; 212.93.152[.]37, a clean residential Romanian line) behaved like real browsers — loaded CSS/images, signed in with the fully domain-qualified [DOMAIN]\[user], pulled the published .rdp, and passed through the RD Gateway. The RDP client also leaked its hostname DESKTOP-[REDACTED], previously seen in unrelated intrusions.

The third IP, 216.152.151[.]168 (flagged US data centre), is the trap for an analyst counting 302s: it used Go-http-client/2.0 (sometimes a bare Mozilla/5.0), lowercased portal paths, submitted a bare username with no domain, and after 127 failed POSTs got one 302 at 21:51:16 on May 15 — then immediately went back to guessing, never pulled the .rdp, never hit the gateway, never appeared in Windows event logs.

flowchart TD
    P[206,444 login POSTs] --> Q{HTTP status}
    Q -->|200 x206,440| F[Failed - noise]
    Q -->|302 x4| S[Success]
    S --> B{Browser behavior?<br/>CSS/images, domain-qualified user,<br/>pulls .rdp, hits RD Gateway}
    B -->|Yes: 80.94.95.37, 212.93.152.37| OP[Operator - real intrusion]
    B -->|No: Go-http-client, bare username,<br/>lowercased paths, no .rdp| BOT[Bot cracked creds,<br/>never used them]

Preconditions / Affected

A single Windows box exposed to the internet on port 443 combining RD Session Host + IIS RDWeb Access + RD Gateway, authenticating domain users by username/password with no MFA. The portal drew 657,521 requests from 8,673 IPs over four days (one source alone ~48,000; a /24 another ~84,000) — constant automated attack is the normal state of such exposure.

What to do

Pull IIS RDWeb logs and pivot on 302 vs 200 to find real successes, then triage each 302 by browser fidelity, whether the username was domain-qualified, whether the .rdp was fetched, whether the session reached the RD Gateway, and whether a matching Event ID 4624 exists. Correlate against Security audit Event ID 4624 for source IP and announced RDP client hostname.

Caveats

A 302 alone does not equal a live intrusion — one here was a credential-stuffing bot that succeeded and walked away, so the log finding must be corroborated against gateway and 4624 evidence. The page text is truncated mid-timeline; later operator activity is not fully shown.

Organisations named here

  • AGETIC
  • Boots
  • CGII
  • dracii.mmp

Technologies named here

  • Microsoft IIS RDWeb Access
  • Huntress agent/EDR
  • Windows Server
  • Gammadyne Mailer
  • RD Gateway
  • Chainsaw
  • ipelc.gob.bo
  • Microsoft Defender
  • RDP
  • IIS
  • Windows
  • Windows Defender

Techniques named here

  • Valid Accounts
  • Brute Force
  • External Remote Services
  • Phishing
  • Compromise Infrastructure / Trusted third-party site
  • Ingress Tool Transfer / staging on victim host
  • Credential harvesting via fake login/survey page
  • Direct-to-MX mail delivery
  • Defense evasion via legitimate signed tooling
  • Fake cryptographic signature / cosmetic PGP block
  • Session reconnection

Threat actors named here

  • Unnamed Romanian threat actor / spam operator
  • Opportunistic credential brute-force bot

Related in Threat Intel