An AI-assembled crew exfiltrating ERP data from Spanish SMBs (huntback.io)

A Russian-speaking cyber intrusion crew has exposed and exfiltrated sensitive ERP data from small and mid-sized businesses (SMBs) in Spain, revealing serious vulnerabilities in cloud infrastructure and enterprise systems. This operation, dubbed "Open Ledger," involved the theft of 15 GB of data from 10 businesses, utilizing a custom-built Microsoft Dynamics 365 exfiltration pipeline that leveraged stolen Azure credentials. The crew's activities were documented through an open directory where they inadvertently left behind 10,428 files, including detailed shell histories and a comprehensive arsenal of exploitation tools. The significance of this incident lies in its advanced, AI-assisted approach, which marks a troubling advancement in cyberattacks where operational tradecraft is increasingly assembled using publicly available tools and code snippets. This incident not only highlights the risks posed by misconfigured cloud services—exemplified by the theft of Azure service-principal secrets—but also emphasizes the breadth of the exploit toolkit, featuring vulnerabilities across several high-profile enterprise applications. Implications for the AI/ML community include a heightened awareness of how AI can be used for malicious purposes in cybersecurity, necessitating a focus on developing defensive measures against such sophisticated, automated threats.