A hacker left the door open. In late July 2026, Group-IB researchers found a publicly accessible directory on a server in Latvia that exposed the working environment of a Russian-speaking operator the company tracks as DarkLunnen: tools, target lists, a stolen firewall configuration and shell histories covering more than 14 months of attacks, with a particular focus on Ukrainian defense and aviation organizations. Group-IB sets out what it recovered in a detailed report.
The operator appeared to be active when the server was found, since the last command in the shell history was dated the same day. Before the directory went offline, the researchers pulled 35 of the 457 exposed files, about 3.1 GB. Group-IB is careful about what that does and does not prove. It has not linked DarkLunnen to any known group or established its nationality or any state affiliation, and many findings rest on recorded commands rather than independent proof of a successful break-in.
A backdoor admin called "service"
The main campaign used a modified version of watchTowr's public proof-of-concept for CVE-2024-55591, a FortiOS authentication bypass, reworked for mass scanning and logging. On success, the script creates a super-admin account named "service". The operator's lists flagged about 600 vulnerable FortiGate devices in Turkey, including at hospitals, industry and municipalities, plus 16 in Ukraine, 14 in Azerbaijan and one in Algeria. Further scanning lists covered Switzerland, South Korea and Ireland, and file names pointed to lists for nine more countries, about 15 in all.
One recovered file closes the loop: a 14,528-line FortiGate 81F configuration from a Romanian organization whose header names the user "service". The operator pulled 10 cleartext VPN passwords from it, and the shell history shows later VPN connection attempts and internal network scanning against that organization.
Drone makers on the target list
The Bash history records runs of git-dumper, a tool that pulls source code from exposed .git folders, against sites linked to Aerorozvidka, Ukraine's volunteer aerial reconnaissance unit, and drone manufacturers UkrSpecSystems and Skyeton, among others. Group-IB found no stolen code and classes these as attempts whose success is unconfirmed. A directory named /root/ukrain was visited 36 times, most recently two days before the discovery.
Other campaigns were broad. A VNC brute-force effort logged 5,775 endpoints as successfully accessed, mostly in Ukrainian and Polish address ranges, and roughly a quarter of a 945-entry results log carried desktop names associated with industrial control panels (HMI). Group-IB stresses that this suggests exposure, not manipulation of industrial processes. The operator also scanned 12,183 Ukrainian camera IPs for the Hikvision flaw CVE-2017-7921 and found eight vulnerable, and the history mentions Exchange webshells and attempts on Roundcube's CVE-2025-49113. Russian keyboard-layout slips and a Russian code comment suggest Russian was the working language, and Moonshot AI's Kimi coding assistant was installed, though how it was used is unknown.
Look for an admin named "service" on FortiGates
Fortinet customers should confirm they are patched against CVE-2024-55591 using Fortinet's advisory, check for an unexpected super-admin account named "service", and rotate VPN credentials on any device that may have been exposed, since a stolen configuration hands over passwords as well as network topology. Do not leave VNC reachable from the internet with guessable passwords, and update or isolate Hikvision cameras affected by CVE-2017-7921. Earlier abuse of the same FortiOS bug is covered in our NightSpire analysis, and this is not the first time an exposed attacker workspace has spilled a playbook.
Indicators
- Operator server and Sliver C2: 46[.]8[.]236[.]121 (open directory on port 8090)
- Staging server: 129[.]146[.]87[.]174 (port 18080)
- Recorded SSH connections: 103[.]28[.]71[.]82, 108[.]175[.]14[.]121, 122[.]155[.]11[.]107, 144[.]91[.]77[.]125
The lesson cuts both ways. An old firewall bug still handed this operator hundreds of potential ways in, and the operator was exposed in turn by exactly the kind of careless internet-facing mistake it spent 14 months hunting for in others.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.