Release the RAVEN: Data Heist and Persistence

This report demonstrates a full post-exploitation playbook against Elasticsearch/Kibana (RCE and compromised Kibana): it shows how an attacker can exfiltrate entire indices and snapshots to disk or a remote cluster, create persistent credential-independent access via API keys and a rogue superuser account, and deploy a Watcher that automatically restores deleted backdoors—making password rotations ineffective. The techniques are presented with commands, modules (exfil, snapshot, apikey, persist), and logging/cleanup mechanisms, illustrating high-impact, stealthy data theft and resilient persistence.