Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline

This report details a large, coordinated cybercrime campaign that leveraged automated mass-scanning and exploitation (including a GlobalProtect authentication bypass), SQL injection chains to achieve remote code execution, credential theft and AD escalation tools, bespoke C2/implant components (AdaptixC2 and an evasion loader), and an extensive fraud “master-panel” used to distribute fake invoices via compromised MS365 accounts, SMS and WhatsApp—resulting in widespread data exfiltration, operational control of multiple hosts, and attempted fraudulent payments totaling hundreds of millions of Brazilian reais.