An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion

Recovered artifacts from an exposed server show a compact post-exploitation toolkit centered on MSSQL and Windows credential theft: PowerShell scripts and Mimikatz-based tools for extracting Windows/DPAPI and browser credentials, SQL credential testing and spraying scripts, and exfiltration utilities. Three tools (exfil.py, upload.py, sqlspray.ps1) were released with SHA256 IOCs; SSMS saved-connection data in the materials indicates likely follow-on targets. Victim-identifying details and DPAPI material were redacted before public release.