The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed

A newly-onboarded customer’s internet-exposed RDWeb/RD Gateway server was accessed with stolen domain credentials by a hands-on operator who staged Gammadyne mailer software and six recipient lists totaling ~8.9M addresses; the operator used the victim host to perform direct-to-MX phishing sends while hosting the phishing kit on a compromised Bolivian government website (ipelc.gob.bo/boots_store/). Huntress detected reconnection activity, isolated all endpoints, blocked outbound SMTP connections (catching ~29,954 blocked attempts in a 104-second burst), severed the RDP session, notified the Bolivian CSIRT, and provided IoCs including source IPs and file hashes for remediation.