Introduction

In late July 2026, Group-IB Threat Intelligence researchers discovered a publicly accessible open directory on a server in Latvia (46[.]8[.]236[.]121:8090). It exposed the working environment of a Russian-speaking threat actor tracked by Group-IB as DarkLunnen. A Python HTTP server on the host exposed the contents of the operator’s /root/ directory, including tools, target lists, stolen device configurations, and shell histories documenting more than 14 months of offensive operations.

The operator appeared to be active at the time of discovery, with the last recorded command in the shell history dating to the same day researchers identified the server. Before the directory went offline, Group-IB researchers recovered 35 of the 457 exposed files, totaling 3.1 GB. These files provide insight into activity targeting FortiGate firewalls, VNC services, Hikvision cameras, and Exchange servers, with a particular focus on Ukrainian defense and aviation organizations.

This investigation reconstructs the observed activity, distinguishes confirmed findings from analytical assessments, and identifies the questions that remain unanswered due to incomplete access to the exposed files. Group-IB has not linked DarkLunnen to any known threat actor or established its nationality or state affiliation. We invite the CTI community to share any available information or potential overlaps with known campaigns, infrastructure, or tactics, techniques, and procedures (TTPs).

Key discoveries

• DarkLunnen  used a modified proof-of-concept (PoC) exploit developed by watchTowr for FortiGate CVE-2024-55591, designed to create a backdoor super-admin account named “service”.  The operator identified approximately 600 vulnerable devices in Turkey, 16 in Ukraine, 14 in Azerbaijan, and 1 in Algeria.
• A stolen FortiGate configuration belonging to a Romanian organization contained the same “service” account. The operator also extracted 10 cleartext VPN passwords from the configuration.
• Ukrainian defense and aviation were among the operator’s apparent targets. Recorded git-dumper commands referenced Aerorozvidka, UkrSpecSystems, and Skyeton, although Group-IB researchers recovered no stolen source code to establish whether these attempts succeeded.
• A VNC brute-force campaign  identified 5,775 reachable endpoints, roughly a quarter displaying desktop names associated with human-machine interfaces (HMI) or industrial control systems (ICS). These findings suggest potential exposure of industrial interfaces but do not establish successful access or manipulation of industrial processes.
• The operator scanned 12,183 Ukrainian and Polish IPs for Hikvision cameras vulnerable to CVE-2017-7921 and identified eight vulnerable devices. The findings indicate attempted targeting but do not confirm that the cameras were compromised.
• Shell command history revealed additional apparent operations, including Exchange webshells, a possible compromise of a German network involving stolen NTLM hash, S3 backup access, exploiting attempts involving Roundcube CVE-2025-49113, a Czech organization backup archive.  Most of these findings are supported by recorded commands rather than independently verified evidence of successful compromise.
• The operator’s Infrastructure included a server in Latvia, a US-hosted Oracle Cloud staging box, SSH connections through the Netherlands, United States, Thailand, and France, and Silver command-and-control (C2) infrastructure running on 46[.]8[.]236[.]121.
• Russian keyboard-layout slips and a Russian code comment suggests that Russian was the operator’s working language. However, these indicators do not establish the operator’s nationality, location, or affiliation with any government.
• The operator installed Moonshot AI’s Kimi coding assistant. The available evidence does not establish whether or how the tool was used during the observed operations.
• The 422 files that researchers could not recover included file listings suggesting the presence of a Sliver database, SSH known_hosts, a Kerberos golden ticket, credential databases, a WireGuard config, custom malware, and a code-signing key. Because these files were not retrieved, their contents and potential relevance to the investigation remain unverified.

Who may find this blog interesting:

• Cybersecurity analysts and corporate security teams
• Malware analysts and incident responders
• Cyber Threat intelligence  researchers and threat hunters
• Cyber investigators and digital forensics specialists
• Computer Emergency Response Teams (CERT)
• Law enforcement investigators and cybercrime units

Group-IB Threat Intelligence Portal: DarkLunnen

Group-IB Threat Intelligence researchers have discovered an Open Directory at 46[.]8[.]236[.]121:8090, exposing  a threat actor’s working environment containing tools, target lists, stolen configurations, and shell command histories  documenting more than 14 months of offensive operations targeting Ukraine  other European countries.

The most recent command recorded in the shell history was timestamped to the same day Group-IB researchers discovered the exposed directory,  suggesting that the operator was still active on the server at the time of the investigation. Analysis of the command histories, tool configurations, target lists, and exfiltrated data revealed multiple concurrent cyberattack campaigns involving different attack techniques, with a particular focus on Ukrainian defense and aviation organizations.

Group-IB researchers were unable to retrieve all the files, as the connection was interrupted during the download process and the exposed directory subsequently became inaccessible. Despite this interruption, Group-IB researchers successfully recovered 35 files totaling 3.1 GB, including shell command histories, a modified FortiGate exploit, a stolen device configuration, campaign target lists, and brute-force attack results.

Research methodology note: The findings presented in this report are based on recovered files and information from the exposed directory listing. Where evidence is incomplete, we distinguish confirmed findings from analytical assessments and highlight the remaining intelligence gaps.

Operator Profile

 Linguistic Indicators: Russian

Attribution note: The linguistic indicators identified during the investigation  suggest that the operator used Russian as a working language. However, they do not establish the operator’s nationality, geographic location, or state affiliation. No information reliably identifying the operator was found in the recovered data.

Two indicators  support the assessment that the operator used Russian as a working language.

First, the shell history contains several instances  in which commands appear to have been entered while a Russian keyboard layout was active,   resulting in Cyrillic characters instead of the intended Latin commands.

For example:

# From chfrt/popoc[.]py, line 12:
# Функция логирования
def log_message(message, log_file=None):

Source: chfrt/popoc[.]py — file downloaded and examined. The comment translates to “Logging function.”

Technical Capability

The observed activity demonstrates a range of advanced offensive capabilities. The operator modified third-party proof-of-concept (PoC) exploits  to incorporate mass-scanning and logging functionality, compiled Go-based tools from source, deployed Sliver command-and-control (C2) infrastructure, and used multiple tunneling tools to facilitate access to internal networks through compromised Exchange servers. The shell history reveals repeated troubleshooting and manual adjustments, suggesting a hands-on human operator involvement rather than exclusively automated activity.

The operator’s shell history records installation of Kimi Code, an AI-powered coding assistant developed by Moonshot AI. Additionally, the open directory listing contains a .jcode/ configuration directory associated with a coding agent harness.  These artifacts suggest that AI-assisted development tools may have been available in the operator’s working environment.

Infrastructure

The primary operator server was hosted on CloudBackbone (AS56971) in Latvia, a hosting provider operated by CGI Global Limited (Hong Kong). A secondary staging server hosted on Oracle Cloud Infrastructure (OCI) in the United States ( AS31898) was used to host exploit scripts and target lists via HTTP on port 18080. The download URLs contained randomized path segments, which may have helped limit casual discovery.

# Staging server downloads observed in .zsh_history: wget hxxp://129[.]146[.]87[.]174:18080/hJCdxq/popoc[.]py wget hxxp://129[.]146[.]87[.]174:18080/UzIwMH/forti-ca.txt wget hxxp://129[.]146[.]87[.]174:18080/aN2MLr/forti_GB.txt wget hxxp://129[.]146[.]87[.]174:18080/OJGWIP/son2.tar.gz

Source: .zsh_history — The recorded downloads span May 2025 through July 2026, with each URL containing a different randomized six-character path segment.

The shell history also records SSH connections to servers in the Netherlands, United States, Thailand, and France. Two connections use non-root usernames (popcloud and sigec) on servers associated with educational institution TLS certificates. This pattern may indicate the use of compromised hosts as intermediary infrastructure, although the available evidence does not independently confirm that these servers were compromised.

# SSH connections from .zsh_history (Apr 30 – May 1, 2026): ssh root@103[.]28[.]71[.]82 # Netherlands, Zenex 5ive (AS209181) ssh root@108[.]175[.]14[.]121 # US, IONOS (AS8560) — cert: all-smart[.]freeddns[.]org ssh popcloud@122[.]155[.]11[.]107 # Thailand, CAT Telecom (AS9335) — cert: *.dltv[.]ac[.]th ssh sigec@144[.]91[.]77[.]125 -p 1702 # France, Contabo (AS51167) — cert: sp-psdebs[.]education-bf[.]com

Source: .zsh_history (timestamps 1777586555–1777647787). TLS certificate subjects were verified using VirusTotal.

Observed Campaigns

#1 Mass FortiGate Exploitation — CVE-2024-55591

The primary campaign involved a modified watchTowr proof-of-concept (PoC) for CVE-2024-55591, a FortiOS authentication bypass vulnerability. The operator modified the script to enable batch scanning, per-target logging, and results reporting. According to the recovered script, successful exploitation would result in the creation of a backdoor administrator account on the affected device.

# From chfrt/popoc[.]py — backdoor account creation: rekt_message = f'\r\nconfig system admin\r\nedit service\r\nset accprofile super_admin \r\nset vdom root\r\nset password \r\nnext\r\nend\r\n'

Source:chfrt/popoc[.]py — downloaded, 293 lines.The script is configured to create an administrator account named service with super_admin privileges following successful exploitation.

The recovered scan results identified FortiGate devices reported as vulnerable across four countries:

Additional FortiGate scanning target lists were recovered for Switzerland (4,725 targets), South Korea (5,199), and Ireland (647). These lists identify scanning targets but do not confirm vulnerability or successful exploitation.

The exposed directory listing also contained references to FortiGate target lists for Romania, Great Britain, France, Canada, Germany, Poland, Slovakia, Mexico, and the United States. However, these files were not recovered for analysis. Together, the available evidence indicates FortiGate-related targeting across 15 countries.

The recovered files also included a 14,528-line FortiGate 81F configuration associated with a Romanian organization. The configuration header references the administrator account service, consistent with the account name specified in the modified exploitation script.

# Config header — note user=service confirming backdoor:
#config-version=FGT81F-7.0.11-FW-build0489-230314:opmode=0:vdom=0:user=service

The operator extracted cleartext VPN credentials from this configuration, as documented in passwds.txt. The recovered command history also records subsequent VPN connection attempts and internal network scanning activity involving the Romanian organization’s infrastructure. These observations suggest a sequence of credential extraction and attempted internal network access, although the extent of successful access requires further confirmation.

#2 Attempted Defense and Aviation Source Code Collection

The recovered Bash command history reveals attempts to collect source code from Ukrainian organizations, with a particular focus on drone technology, aviation, and aerial reconnaissance. The recorded activity includes git-dumper commands targeting domains associated with Ukrainian defense and aviation organizations, including Aerorozvidka, UkrSpecSystems, and Skyeton.

# From .bash_history — git-dumper targeting Ukrainian defense/aviation:
git-dumper -r 3 -t 10 hxxps://aerorozvidka[.]ngo/ ua2
git-dumper -r 3 -t 10 hxxps://sg.aerorozvidka[.]ngo/ ua2
git-dumper -r 3 -t 10 hxxps://vpn.aerorozvidka[.]ngo/ ua2
git-dumper -r 3 -t 10 hxxps://www[.]aerorozvidka[.]xyz/ ua2
git-dumper -r 3 -t 10 hxxps://ukrspecsystems[.]com/ ua2
git-dumper -r 3 -t 10 hxxps://skyeton[.]com/ ua2
git-dumper -r 3 -t 10 hxxps://warbirds[.]com[.]ua/ ua2
git-dumper -r 3 -t 10 hxxps://ukrjet[.]ua/ ua2
git-dumper -r 3 -t 10 hxxps://git.ukrjet[.]ua ua2

Source: .bash_history — downloaded file. Aerorozvidka is Ukraine’s volunteer aerial reconnaissance unit. UkrSpecSystems and Skyeton are drone manufacturers. All output was directed to a local “ua2” directory. 

Analyst note regarding evidence classification — success not confirmed:

The recovered Bash history confirms that the operator executed commands intended to extract source code from the targeted organizations. However, no corresponding output artifacts—including the ua2/ directory, extracted source files, or compressed archives—were identified among the 457 files enumerated in the exposed directory listing.

The git-dumper tool relies on an accessible .git directory to retrieve repository contents. The recorded commands therefore demonstrate attempted extraction, but do not establish that the targeted repositories were accessible or that any source code was successfully obtained.

For an earlier attempt targeting e-learning[.]iir[.]edu[.]ua (output directory: ua1/), the Bash history records subsequent compression and upload commands involving the temporary file-sharing service temp[.]sh. This sequence suggests possible data collection, but the resulting archive was not recovered and its contents could not be verified.

Based on the available evidence, Group-IB assesses these activities as attempted source code collection operations. Their success remains unconfirmed.

The recovered HTTP Strict Transport Security (HSTS) database contains an entry associated with ukroboronprom[.]com[.]ua, a domain linked to Ukraine’s state defense industry, dating to April 14, 2025:

# From .wget-hsts:
ukroboronprom[.]com[.]ua 0 0 1744669387 300

The Timestamp 1744669387  corresponds to April 14, 2025. Separately, the bash history records wget https://ukroboronprom[.]com[.]ua/web.config.

The recovered zoxide directory history also records 36 visits to a directory named /root/ukrain, with the most recent entry dated July 24, 2026, two days before the discovery of the open directory:

# From .z (zoxide directory history): /root/ukrain|36|1784894586

#3 VNC Brute-Force Campaign

The recovered files reveal a large-scale brute-force campaign targeting Virtual Network Computing (VNC) services, which enable remote access to computer systems. The file pl/good.txt contains 5,775 entries reported as successfully authenticated VNC endpoints, primarily associated with Ukrainian and Polish IP address ranges.

A separate brute-force results log, pl/bruteforced.log (945 entries), records VNC (TCP/5900) login attempts and the desktop name each server returned. Roughly a quarter of the entries carry names associated with human-machine interface (HMI) panels, which suggests the campaign also reached industrial control system (ICS) environments.

Examples from the recovered brute-force results (victim IP addresses redacted):

# From pl/bruteforced.log — ICS/SCADA indicator (victim IPs redacted): :5900:Admin@1980:HMI WebServer :5900:Admin@1980: :5900:Admin@1980: :5900:1234567899:x11vnc

Source: pl/bruteforced.log — 945 entries.

Analyst note:

The HMI-related desktop names include about 180 instances of HMI WebServer, Weintek cMT-series model designations (e.g., cMT3162X, cMT3072X, cMT-FHDX-220) and B&R visualization projects. The rest are generic Linux and Windows hosts and hypervisor consoles. Of the 945 entries, 28 use the password Admin@1980, a common dictionary password. VNC servers send their desktop name only after a successful login, so named entries most likely represent successful access. These findings indicate access to HMI interfaces but do not confirm that the operator manipulated industrial processes. Some hosts appear multiple times, so the number of unique devices is probably lower than 945.

#4 HikVision Surveillance Camera Infiltration

The recovered files indicate that the operator targeted 12,183 IP addresses in a campaign involving CVE-2017-7921, an authentication bypass vulnerability affecting certain Hikvision surveillance cameras. Of these targets, eight were identified as vulnerable in the recovered results. All listed targets appear to be associated with Ukrainian IP address ranges.

The recovered results include snapshot URLs containing encoded authentication credentials:

# From HikVision-CVE-2017-7921/vulnerable.txt — 8 confirmed cameras
(IPs redacted — these are victims):
http://:8107/onvif-http/snapshot?auth=YWRtaW46MTEK
http://:80/onvif-http/snapshot?auth=YWRtaW46MTEK
http://:80/onvif-http/snapshot?auth=YWRtaW46MTEK
... (5 additional entries, same pattern)

Source: HikVision-CVE-2017-7921/vulnerable.txt — recovered file containing eight entries.

The auth token YWRtaW46MTEK decodes from base64 to admin:11. The associated target list targets.txt contains 12,183 entries.

Analyst note:

The recovered results identify eight cameras as vulnerable and contain URLs with encoded authentication credentials. However, the available evidence does not independently establish whether the operator successfully accessed camera feeds, retrieved images, or maintained access to the affected devices. These findings therefore support vulnerability identification and attempted access, rather than confirmed surveillance camera compromise.

#5 Additional Operations Observed in Command History

The recovered shell history documents several additional operations conducted during the period covered by the investigation. These activities involved a range of offensive tools and techniques, including web shell deployment, network reconnaissance, credential-based access attempts, exploitation, and data retrieval.

For several of these operations, the available evidence is limited to recorded commands. Unless otherwise indicated, the findings do not independently confirm successful exploitation, unauthorized access, or data exfiltration.

Attribution Assessment

The recovered evidence provides insight into the operator’s working environment, technical capabilities, and targeting priorities. Linguistic indicators suggest that the operator used Russian as a working language, while the observed activity demonstrates a particular focus on Ukrainian organizations, including those associated with defense, aviation, and critical infrastructure.

Based on the available evidence, Group-IB has not attributed these activities to a previously identified threat actor. The operator therefore remains unclassified pending further investigation.

Group-IB encourages collaboration with the wider threat intelligence community to identify potential overlaps with known campaigns, infrastructure, tools, and tactics, techniques, and procedures (TTPs) that may help clarify attribution and take this research further.

Operational Timeline

Group-IB researchers reconstructed the operational timeline using timestamped entries from the recovered .zsh_history file (993 commands with individual timestamps), directory visit records from .z (zoxide), and HTTP Strict Transport Security (HSTS) records from .wget-hsts.

An additional 527 commands in .zsh_history share an import timestamp of May 31, 2025, at 18:54:22 UTC. These commands originated from .bash_history, which does not contain individual timestamps, and therefore cannot be reliably dated.

The recovered evidence indicates operator activity on at least 84 distinct days over a period spanning approximately 14 months.

Before May 31, 2025 — Undated Bash History

The recovered .bash_history file contains 1,368 commands without individual timestamps. The earliest independently dated artifact is an HSTS record associated with ukroboronprom[.]com[.]ua, dated April 14, 2025.

 May 31, 2025, Onward — Timestamped Activity

Data Overview

The open directory at 46[.]8[.]236[.]121:8090 exposed files from the root home directory of a Linux server used as a platform for offensive operations. The HTTP service (SimpleHTTP/0.6 Python/3.10.12) served the entire /root/ filesystem.

The server, hosted on CloudBackbone infrastructure (AS56971) in Latvia, was serving the operator’s complete working environment.

The Full directory listing can be found in Appendix A below. 

The server’s directory listing revealed 457 files. We recovered 35 before it went offline. The remaining 422 files — visible in the enumerated file manifest — include binaries, databases, SSH keys, custom exploits, and campaign infrastructure that would have been decisive for deeper analysis and attribution. This section documents what was visible, the inferences the filenames support, and the intelligence questions that remain open.

The unrecovered files represent significant intelligence gaps. Below, we outline what each category of missing files could reveal, and the questions they leave unanswered. We invite the CTI community to extend this research wherever these artifacts intersect with existing investigations.

1. Custom Malware and Binaries

gbr/hp.exe — A Windows PE binary in a campaign directory visited 21 times. The gbr/ directory also contains neo-cmd (unknown binary), yuze-Linux-X64-clang[.]zip (a compiled reverse shell tool by P001water), and target and note files. The directory name “gbr” could reference a campaign codename, a country (Great Britain), or something else entirely.

Open question: Is hp.exe a custom RAT, a modified public tool, or commodity malware? Its presence alongside neo-cmd and yuze in a dedicated campaign directory suggests operational tooling rather than an installation artifact. If any researcher has encountered this filename pattern or the “gbr” campaign designation in other investigations, such a correlation would be valuable.

2. Sliver C2 Database

.sliver/sliver.db (+ WAL and SHM files) — The SQLite database for the Sliver C2 framework, deployed on July 21, 2026. This database contains implant configurations, generated payloads, active session records, and operator metadata. The shell history confirms that the Sliver server was downloaded from GitHub (v1.7.3) and started on this server just five days before our discovery.

Open question: What implants were generated? What victims were beaconing back? The .sliver-client/history file (also unrecovered) would contain the operator’s C2 command history. Organizations that observe Sliver beacons connecting to 46[.]8[.]236[.]121 should consider this a confirmed C2 address for this actor.

3. SSH Keys and Infrastructure Map

.ssh/known_hosts — Every server the operator connected to via SSH. This file would map the actor’s full infrastructure network — not just the five hop-points visible in the shell history, but potentially dozens of additional compromised or controlled servers.

.ssh/authorized_keys — The public keys authorized to access this operator server. If the same keys appear on other servers in other investigations, that would constitute a strong infrastructure linkage.

Open question: How large is this actor’s infrastructure network beyond the two confirmed servers (operator + staging)? The SSH hop-points in the shell history (NL, US, TH, FR) are likely a subset. The known_hosts file would reveal the full scope.

4. Identity and Attribution Artifacts

.kimi/device_id and .kimi/config.toml — The operator installed Kimi Code (Moonshot AI’s coding assistant). The device_id file would contain a unique identifier tied to the operator’s Kimi account. The config.toml may contain authentication tokens or account metadata.

.jcode/telemetry_id — A telemetry identifier from the operator’s remote IDE. Combined with the session GUID visible in the filename (648862ba-e9c9-48d0-93e1-d447cf850695), this could serve as a cross-investigation fingerprint.

key.pvk — A Windows private key file (PVK format) used for code signing. If this key was used to sign malware distributed in the wild, the signature would link to this actor.

Open question: Can the Kimi device_id or .jcode telemetry_id be correlated with activity on other servers? The .jcode session GUID 648862ba-e9c9-48d0-93e1-d447cf850695 is visible in the manifest filename — this alone may be searchable in telemetry datasets.

Open question: Is the PVK stolen or self-generated, and was it used to sign binaries in the wild? If the corresponding certificate was used to sign malware (or the gbr/hp.exe binary on the same server), that signature would be a hard attribution link.

5. WireGuard VPN Topology

wg0-client-LinuxDataShare.conf — A WireGuard VPN client configuration file. WireGuard configs contain the server’s public key, endpoint IP:port, allowed IP ranges, and the client’s private key. The filename “LinuxDataShare” suggests that this VPN connects to a data-sharing or exfiltration infrastructure. The /root/wireguard directory was the most frequently visited directory on the server (76 visits).

Open question: What is the WireGuard VPN endpoint? The configuration file would reveal the VPN server’s IP address and the internal network topology. The name “DataShare” is suggestive — is this shared infrastructure used by multiple operators?

6. Unknown Campaigns

Several directory names in the manifest correspond to campaigns that we cannot fully characterize from the recovered data:

7. Kerberos Golden Ticket

it/pwned_golden.ccache — A file named “pwned_golden.ccache” in the it/ directory. The .ccache format stores Kerberos tickets. A “golden” ticket grants unrestricted access to an Active Directory domain for an attacker-defined period. The it/ parent directory may designate an “IT” campaign or an Italian target. The ccache file would contain the target domain’s SID and the krbtgt key — both of which would identify the victim organization.

Open question: Which Active Directory domain was fully compromised? The pwned_golden.ccache file contains the target domain’s SID and the krbtgt NTLM hash — both uniquely identify the victim organization.

8. Credential and Victim Databases

.donpapi/donpapi.db — DonPAPI extracts DPAPI-protected credentials (browser passwords, Wi-Fi keys, Windows vault entries). This database would contain all credentials harvested across the actor’s operations.

Responder/Responder.db — SQLite database of NTLM hashes captured via LLMNR/NBT-NS poisoning. Would reveal which networks Responder was deployed in and how many credentials were captured.

hashlist — Password hashes staged for offline cracking. The format and source are unknown.

Open question: which organizations were compromised, what credentials were harvested, which were cracked, which were reused for further access.

Data Legitimacy Assessment

We assessed the recovered data for indicators of honeypot deployment, fabrication, or deliberate deception. The data was assessed as legitimate with high confidence. 

The strongest indicators of authenticity:

• Credential cross-referencing across 3 independent files: FortiGate configuration → password extraction output → VPN connection commands using those exact credentials, with timestamps in sequence.
• Tool installation struggles: 30+ commands troubleshooting Go installation, 20+ commands resolving Evil-WinRM dependencies, and 25+ commands debugging VNC brute-forcer builds.  These details offer no apparent value in a fabricated dataset.
• Realistic mistake patterns: Cyrillic keyboard errors at the start of commands, and incorrect country code (“SW” instead of “SE” producing an empty results file), typos scattered naturally across 14 months.
• Passive target verification: All sampled target IPs were confirmed as real infrastructure running the claimed services in the reported countries using internet scanners such as Shodan.

Appendix A – Directory Tree

46[.]8[.]236[.]121:8090/

├── .bash_history

├── .bashrc

├── .cache/

│ ├── motd.legal-displayed

│ ├── p10k-dump-root.zsh

│ ├── p10k-dump-root.zsh.zwc

│ ├── p10k-instant-prompt-root.zsh

│ └── p10k-instant-prompt-root.zsh.zwc

├── .cme/

│ ├── cme.conf

│ └── cme.pem

├── .donpapi/

│ ├── debug.log

│ ├── donpapi.conf

│ └── donpapi.db

├── .fonts/

│ ├── .uuid

│ ├── DejaVuSansMNerdFont-Regular.ttf

│ ├── HackNerdFont-Regular.ttf

│ └── RobotoMonoNerdFont-Regular.ttf

├── .fzf.bash

├── .fzf.zsh

├── .jcode/

│ ├── last_focused_client_session

│ ├── last_seen_changelog

│ ├── servers.json

│ ├── sessions-bak-prune.stamp

│ ├── setup_hints.bak

│ ├── setup_hints.json

│ ├── telemetry_id

│ ├── telemetry_session_starts_648862ba-e9c9-48d0-93e1-d447cf850695.txt

│ ├── telemetry_version_sent

│ └── update_metadata.json

├── .kimi/

│ ├── config.toml

│ ├── device_id

│ ├── kimi.json

│ └── latest_version.txt

├── .npm/

│ └── _update-notifier-last-checked

├── .nxc/

│ └── nxc.conf

├── .profile

├── .pyenv/

│ ├── .agignore

│ ├── .dockerignore

│ ├── .editorconfig

│ ├── .gitignore

│ ├── .vimrc

│ ├── CHANGELOG.md

│ ├── COMMANDS.md

│ ├── CONDUCT.md

│ ├── CONTRIBUTING.md

│ ├── Dockerfile

│ ├── LICENSE

│ ├── MAINTENANCE.md

│ ├── Makefile

│ ├── README.md

│ ├── install_local_python.gif

│ └── terminal_output.png

├── .python_history

├── .shiv/

│ └── .cme_9a05fe85b9528115f9515b14e17aeeca9011f83cdd1e4c72acc93bc284a1e467_loc

├── .sliver-client/

│ ├── history

│ ├── sliver-client.log

│ ├── spoof-metadata.yaml

│ ├── theme.yaml

│ ├── tui-settings.yaml

│ └── version

├── .sliver/

│ ├── adjectives.txt

│ ├── nouns.txt

│ ├── sliver.db

│ ├── sliver.db-shm

│ ├── sliver.db-wal

│ └── version

├── .ssh/

│ ├── authorized_keys

│ ├── known_hosts

│ └── known_hosts.old

├── .todo.cfg

├── .wezterm.lua

├── .wget-hsts

├── .wrk/

│ ├── 1.log

│ └── newpoc.py

├── .z

├── .zcompdump

├── .zcompdump-test-5.8.1

├── .zcompdump-test-5.8.1.zwc

├── .zsh_history

├── .zshenv

├── .zshrc

├── 1111/

│ ├── LICENSE

│ ├── README.md

│ ├── README_en.md

│ ├── gost

│ └── gost_2.12.0_linux_amd64.tar.gz

├── AutomBackupCZ.zip

├── AutomBackupCZ.zip.1

├── CVE-2025-24071_PoC/

│ ├── README.md

│ ├── exploit.zip

│ └── poc.py

├── CVE-2025-31324/

│ ├── CVE-2025-31324.py

│ ├── LICENSE

│ ├── README.md

│ ├── nshell.jsp

│ └── shell.jsp

├── HikVision-CVE-2017-7921/

│ ├── README.md

│ ├── main.py

│ ├── requirements.txt

│ ├── targets.txt

│ └── vulnerable.txt

├── IPGeoLocation/

│ ├── .gitignore

│ ├── 1t

│ ├── LICENSE

│ ├── README.md

│ ├── ipgeolocation.py

│ ├── requirements.txt

│ └── results.txt

├── Ingram/

│ ├── .gitignore

│ ├── LICENSE

│ ├── README.en.md

│ ├── README.md

│ ├── requirements.txt

│ └── run_ingram.py

├── LICENSE

├── Lunnen Outer 16 (LL6FIWG05_LL6FIWO05_LL6FIWL05).zip

├── Python-3.9.12.tgz

├── Python-3.9.12/

│ ├── .editorconfig

│ ├── CODE_OF_CONDUCT.md

│ ├── LICENSE

│ ├── Makefile.pre.in

│ ├── README.rst

│ ├── aclocal.m4

│ ├── config.guess

│ ├── config.sub

│ ├── configure

│ ├── configure.ac

│ ├── install-sh

│ ├── netlify.toml

│ ├── pyconfig.h.in

│ └── setup.py

├── README.md

├── README_en.md

├── Responder/

│ ├── .gitignore

│ ├── CHANGELOG.md

│ ├── Contributors

│ ├── DumpHash.py

│ ├── LICENSE

│ ├── OSX_launcher.sh

│ ├── README.md

│ ├── Report.py

│ ├── Responder.conf

│ ├── Responder.db

│ ├── Responder.py

│ ├── odict.py

│ ├── packets.py

│ ├── requirements.txt

│ ├── settings.py

│ └── utils.py

├── all-2.0.tar.gz

├── chfrt/

│ ├── 1pop.py

│ ├── _hn1

│ ├── acv-gw_7-0_0489_202506271512.conf

│ ├── az

│ ├── ch_ca

│ ├── expithink.py

│ ├── fortipwkey

│ ├── fortiv4 python3.zip

│ ├── h_az

│ ├── h_tr

│ ├── h_ua

│ ├── h_ua_n

│ ├── ip.txt

│ ├── l_u

│ ├── n1

│ ├── passwds.txt

│ ├── popoc.py

│ ├── sk

│ ├── st.sh

│ ├── tr

│ ├── u_az

│ ├── u_de

│ ├── u_fr

│ ├── u_gb

│ ├── u_pl

│ ├── u_s_de

│ ├── u_sk

│ ├── u_tr

│ ├── u_u2

│ ├── u_ua

│ ├── u_us

│ ├── ua

│ ├── ua_n

│ ├── urlto.sh

│ ├── v_az

│ ├── v_n1

│ ├── v_tr.txt

│ ├── v_ua.txt

│ └── vulnerable_targets.txt

├── cip_ua/

│ ├── assetfinder

│ └── domains.txt

├── citr/

│ ├── PoC.py

│ ├── ci

│ ├── ct

│ ├── exploit.log

│ ├── h_ci

│ └── h_ct

├── cme

├── cme-ubuntu-latest-3.10.zip

├── dirve_all.zip

├── discord_users-data.json

├── down.sh

├── drove_all_2.zip

├── educate/

│ └── test.py

├── eppo.lst

├── exp/

│ └── newpoc.py

├── ez_error.log

├── ez_linux_amd64

├── ez_linux_amd64.zip

├── f5/

│ └── tst

├── fgate_ch.json

├── fgate_irl.json

├── fgate_kr.json

├── fgate_sw.json

├── frt/

│ └── forti.tar.gz

├── fscan

├── fvds/

│ ├── 3108.txt

│ ├── cred.txt

│ └── ip_554.txt

├── gbr/

│ ├── all_note

│ ├── all_note2

│ ├── hp.exe

│ ├── ip1

│ ├── neo-cmd

│ └── yuze-Linux-X64-clang.zip

├── go1.24.2.linux-amd64.tar.gz

├── go1.25.5.linux-amd64.tar.gz

├── gost/

│ ├── .dockerignore

│ ├── .gitignore

│ ├── .goreleaser.yaml

│ ├── .travis.yml

│ ├── Dockerfile

│ ├── LICENSE

│ ├── Makefile

│ ├── README.md

│ ├── README_en.md

│ ├── auth.go

│ ├── auth_test.go

│ ├── bypass.go

│ ├── bypass_test.go

│ ├── chain.go

│ ├── client.go

│ ├── common_test.go

│ ├── dns.go

│ ├── forward.go

│ ├── forward_test.go

│ ├── ftcp.go

│ ├── go.mod

│ ├── go.sum

│ ├── gost.go

│ ├── gost.png

│ ├── handler.go

│ ├── handler_test.go

│ ├── hosts.go

│ ├── hosts_test.go

│ ├── http.go

│ ├── http2.go

│ ├── http2_test.go

│ ├── http_test.go

│ ├── kcp.go

│ ├── kcp_test.go

│ ├── log.go

│ ├── mux.go

│ ├── node.go

│ ├── node_test.go

│ ├── obfs.go

│ ├── obfs_test.go

│ ├── permissions.go

│ ├── permissions_test.go

│ ├── quic.go

│ ├── quic_test.go

│ ├── redirect.go

│ ├── redirect_other.go

│ ├── relay.go

│ ├── reload.go

│ ├── resolver.go

│ ├── resolver_test.go

│ ├── selector.go

│ ├── selector_test.go

│ ├── server.go

│ ├── signal.go

│ ├── signal_unix.go

│ ├── sni.go

│ ├── sni_test.go

│ ├── sockopts_linux.go

│ ├── sockopts_other.go

│ ├── socks.go

│ ├── socks_test.go

│ ├── ss.go

│ ├── ss_test.go

│ ├── ssh.go

│ ├── ssh_test.go

│ ├── tcp.go

│ ├── tls.go

│ ├── tls_test.go

│ ├── tuntap.go

│ ├── tuntap_darwin.go

│ ├── tuntap_linux.go

│ ├── tuntap_unix.go

│ ├── tuntap_windows.go

│ ├── udp.go

│ ├── vsock.go

│ ├── ws.go

│ ├── ws_test.go

│ └── wss_test.go

├── gost_2.12.0_linux_amd64.tar.gz

├── gs-netcat_linux-x86_64

├── h_lsyt

├── h_new

├── h_rab

├── hashlist

├── impacket-old/

│ └── impacket-0.10.0.tar.gz

├── impacket/

│ ├── .gitignore

│ ├── ChangeLog.md

│ ├── Dockerfile

│ ├── LICENSE

│ ├── MANIFEST.in

│ ├── README.md

│ ├── SECURITY.md

│ ├── TESTING.md

│ ├── requirements-test.txt

│ ├── requirements.txt

│ ├── setup.py

│ └── tox.ini

├── install.sh

├── ip_ports.txt

├── ip_ports_all.json

├── iperf3_3.18-2_amd64.deb

├── ips/

│ └── fscan

├── it/

│ └── pwned_golden.ccache

├── key.pvk

├── list.tst

├── listt

├── lst

├── masscan/

│ ├── .gitattributes

│ ├── .gitignore

│ ├── 80.txt

│ ├── 8080.txt

│ ├── LICENSE

│ ├── Makefile

│ ├── README.md

│ ├── VULNINFO.md

│ ├── ip_554.txt

│ ├── ip_5900.txt

│ ├── ip_7010.txt

│ ├── ip_8000.txt

│ ├── ip_8001.txt

│ ├── ip_8002.txt

│ ├── ip_80_8080.txt

│ ├── ip_ports.txt

│ ├── out_554.log

│ ├── out_5900.log

│ ├── out_80.log

│ ├── out_mass.log

│ ├── out_ua_5900.log

│ ├── out_ua_7000.log

│ ├── out_ua_8000.log

│ ├── out_ua_8001.log

│ ├── out_ua_8002.log

│ ├── paused.conf

│ ├── pl.cidr

│ └── ua.cidr

├── nuclei-templates/

│ ├── .checksum

│ ├── .new-additions

│ ├── .templates-index

│ ├── CODE_OF_CONDUCT.md

│ ├── CONTRIBUTING.md

│ ├── Community-Rewards-FAQ.md

│ ├── LICENSE.md

│ ├── PULL_REQUEST_TEMPLATE.md

│ ├── README_CN.md

│ ├── README_JA.md

│ ├── README_KR.md

│ ├── TEMPLATES-STATS.json

│ ├── TEMPLATES-STATS.md

│ ├── TOP-10.md

│ ├── contributors.json

│ ├── cves.json

│ ├── cves.json-checksum.txt

│ ├── templates-checksum.txt

│ └── wappalyzer-mapping.yml

├── o_epp

├── out_ibm

├── out_lst

├── out_new

├── pl/

│ ├── 1p.txt

│ ├── Passwords-6.txt

│ ├── Poland 1.txt

│ ├── bad.txt

│ ├── bruteforced.log

│ ├── compare_files_unique_lines.py

│ ├── dicts.txt

│ ├── good.txt

│ ├── ips.txt

│ ├── ips_g.txt

│ ├── l1.txt

│ ├── list.txt

│ ├── newlist.txt

│ ├── np1.txt

│ ├── old_good.txt

│ ├── old_list.txt

│ ├── only_ips_good.txt

│ ├── pl_vnc_log1.log

│ ├── pl_vnc_log2.log

│ ├── pl_vnc_log3.log

│ ├── pl_vnc_log4.log

│ ├── pl_vnc_log5.log

│ ├── pl_vnc_log6.log

│ ├── pl_vnc_log7.log

│ ├── pl_vnc_log8.log

│ ├── pl_vnc_log9.log

│ ├── sgp.txt

│ ├── treu_pass.txt

│ ├── u1.txt

│ ├── ua_l1.txt

│ ├── ua_vnc_log1.log

│ ├── ua_vnc_log2.log

│ ├── ua_vnc_log3.log

│ ├── unique_lines.txt

│ ├── vnc_25

│ └── vnc_check.py

├── powerview.py/

│ ├── .gitignore

│ ├── LICENSE

│ ├── MANIFEST.in

│ ├── README.md

│ ├── flake.lock

│ ├── flake.nix

│ ├── install.sh

│ ├── powerview.py

│ ├── pyproject.toml

│ ├── requirements.txt

│ └── uv.lock

├── proxyscan

├── prxy_found.txt

├── pupetter_output.js

├── pywsus/

│ ├── .gitignore

│ ├── LICENSE

│ ├── README.md

│ ├── pywsus.py

│ └── requirements.txt

├── reGeorg/

│ ├── LICENSE.html

│ ├── LICENSE.txt

│ ├── README.md

│ ├── reGeorgSocksProxy.py

│ ├── tunnel.ashx

│ ├── tunnel.aspx

│ ├── tunnel.js

│ ├── tunnel.jsp

│ ├── tunnel.nosocket.php

│ ├── tunnel.php

│ └── tunnel.tomcat.5.jsp

├── restic.txt

├── scanpxy

├── suo5

├── web.config

├── wg0-client-LinuxDataShare.conf

├── wget-log

└── wireguard-install.sh