Exposed WebDAV Malware Lab Reveals Stealth Falcon Activity

A recently discovered malware delivery infrastructure, dubbed 'Simba Service,' has exposed the operational tradecraft of suspected threat actor Stealth Falcon. The server functioned as a high-volume QA and distribution hub, hosting over 1,000 files including lures, testing matrices, and modular payloads. The investigation highlighted a significant shift in adversary methodology, where attackers leveraged Generative AI (LLMs) to automate the creation of phishing lures, technical README documentation, and testing frameworks for N-day exploits.

The primary activity observed was the 'CURP' campaign targeting Mexico, which utilized a typosquatted government portal to trick users into downloading malicious .scr files via WebDAV. Technical analysis reveals a methodical approach to exploiting CVE-2025-33053 (Windows Internet Shortcut flaw) and other vulnerabilities, transitioning from delivery to the deployment of PureRAT, a .NET-based information stealer.

This case demonstrates the maturation of 'malware-as-a-product' workflows, where attackers use automated testing to bypass security controls like SmartScreen and MoTW. The exposure of internal documentation, hardcoded credentials, and tracking panels provides defenders a rare end-to-end view of the adversary's staging and execution pipeline.