Executive Summary
Between September 25 and 29, 2026, ThreatMon identified an unauthenticated attacker staging server (151.243.232[.]123) that exposed a specialized post-exploitation toolkit and stolen metadata. The intrusion targeted a Microsoft SQL Server environment, leveraging the `xp_cmdshell` procedure to execute commands and bypass traditional exfiltration detection by returning Base64-encoded data chunks through SQL query results.
Technically, the actor focused on credential harvesting from Windows Vault, browser stores, and SQL Server Management Studio (SSMS) metadata to prepare for lateral movement. The exposure of the attacker's own infrastructure led to a secondary risk, where unrelated internet hosts were observed accessing the stolen loot and tools shortly after the initial compromise.
While there is no evidence confirming the theft of sensitive passenger or payment data, the incident underscores the high risk of enabled legacy SQL features and the potential for rapid secondary exposure when attackers fail to secure their own command-and-control infrastructure.