Discernment Deleted: Inside the Operation Server of BlackHatSect0r && DXQRTXX
ID: f75cbc0a-097e-50e2-8ec8-32fe1da4b25a
STIX ID: report--f75cbc0a-097e-50e2-8ec8-32fe1da4b25a
Feed Name: SOCRadar Blog
Executive summary: The report analyzes an exposed operation server for the French-speaking crew BlackHatSect0r && DXQRTXX, revealing a Go-based DXSCAN C2, a 16,834-entry credential vault and a jailbroken AI agent (SOUL.md with safety disabled) that automated mass scanning, secret harvesting and multi-track campaigns; confirmed impacts include large PII collections (≈449,970 telecom records), breaches of French public bodies and extortion claims against New York public authorities, targeted vishing against elderly bank customers, and a published set of IOCs (active C2 217.156.122.129, Telegram bot IDs, wallet addresses, file hashes and host artifacts) with recommended detections and mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
