Exposed Hacker Server Reveals Toolkit Used in Viva Aerobus-Linked Intrusion

ThreatMon discovered an unauthenticated attacker staging server (151.243.232.123) used to deliver payloads and host stolen material tied to an intrusion against a Viva Aerobus-side Microsoft SQL Server environment. Attackers leveraged xp_cmdshell to run cmd.exe and Base64 PowerShell under the SQL Server service account, used credential-dumping tools (Mimikatz, browser and Vault targeting), collected SSMS metadata and configuration (potentially exposing stored connections and credentials), and staged files for exfiltration via SQL query output; ThreatMon published SHA-256 IOCs for some tools and recommended disabling xp_cmdshell, rotating exposed credentials, and reviewing service-account privileges.