Full Report
An APT hacking group known as 'Stealth Falcon' exploited a Windows WebDav RCE vulnerability in zero-day attacks since March 2025 against defense and government organizations in Turkey, Qatar, Egypt, and Yemen. [...]
Analysis Summary
# Incident Report: Exploitation of Windows WebDAV Zero-Day by Stealth Falcon
## Executive Summary
The threat actor group Stealth Falcon exploited a newly identified Windows WebDAV zero-day vulnerability (CVE-2025-33053) to gain initial access and deploy sophisticated, multi-stage malware known as "Horus Loader" and "Horus Agent." The attack chain utilizes remote execution via `iediagcmd.exe` to establish persistence and ultimately enable espionage activities, indicating an evolution in the group's capabilities.
## Incident Details
- **Discovery Date:** Not explicitly stated, but likely shortly before the Microsoft June 2025 Patch Tuesday which addressed the flaw.
- **Incident Date:** Occurred prior to the patching of the vulnerability.
- **Affected Organization:** Specific organizations were not named, but the context suggests critical organizations targeted for espionage.
- **Sector:** Espionage/Government-related operations implied.
- **Geography:** Not disclosed.
## Timeline of Events
### Initial Access
- **Date/Time:** Unknown, active prior to patch release.
- **Vector:** Exploitation of the Windows WebDAV feature via a zero-day vulnerability (CVE-2025-33053).
- **Details:** Attackers crafted malicious WebDAV shares. Exploitation causes `iediagcmd.exe` to execute an attacker-controlled `route.exe` program directly from the remote server, bypassing standard execution controls.
### Lateral Movement
- **Details:** Not explicitly detailed, but the deployment of a custom C2 implant suggests post-exploitation command execution and system discovery.
### Data Exfiltration/Impact
- **Details:** The primary goal appears to be espionage. Post-exploitation tools included a credential file dumper and a keylogger, indicating intent to harvest sensitive data.
### Detection & Response
- **How it was discovered:** Discovered by security researchers (Check Point) during analysis of the threat actor's activities.
- **Response actions taken:** Microsoft released a patch (June 2025 Patch Tuesday) addressing CVE-2025-33053.
## Attack Methodology
- **Initial Access:** Exploitation of **CVE-2025-33053** (Windows WebDAV zero-day) via remote execution of a fake `route.exe`.
- **Persistence:** Established via the custom **'Horus Loader'**, which subsequently deployed the **'Horus Agent'** (a C++ Mythic C2 implant). A passive backdoor C service was also deployed to listen for encrypted shellcode.
- **Privilege Escalation:** Not explicitly detailed, but likely leveraged standard operating system permissions following initial compromise via the WebDAV flaw.
- **Defense Evasion:** The custom, modular nature of the Horus toolset suggests advanced evasion techniques designed for operational stealth.
- **Credential Access:** Post-exploitation tool deployed: **Credential file dumper**.
- **Discovery:** Included system fingerprinting via C2 commands.
- **Lateral Movement:** Implied through C2 capabilities, but specific techniques were not detailed.
- **Collection:** **Keylogger** deployed for data gathering.
- **Exfiltration:** Not explicitly detailed, but the use of espionage tools implies data exfiltration.
- **Impact:** Establishment of advanced C2 infrastructure for long-term espionage.
## Impact Assessment
- **Financial:** Not specified.
- **Data Breach:** Credential files and potentially other sensitive data targeted via dumping and keylogging.
- **Operational:** Potential long-term compromise for espionage purposes.
- **Reputational:** Not specified.
## Indicators of Compromise
- **Network indicators:** Suspicious outbound connections to unknown endpoints concerning WebDAV traffic (Monitor closely if patching is delayed).
- **File indicators:** `route.exe` (attacker-controlled), 'Horus Loader,' 'Horus Agent' (custom C++ implant).
- **Behavioral indicators:** Execution of `iediagcmd.exe` leading to remote code execution from a WebDAV share; presence of a tiny C service listening passively for encrypted shellcode over the network.
## Response Actions
- **Containment measures:** Block or closely monitor suspicious outbound WebDAV traffic to unknown endpoints, particularly if patching is delayed.
- **Eradication steps:** Not detailed, but would involve wiping compromised systems and removing all stages of Horus Loader/Agent and the backdoor service.
- **Recovery actions:** Applying Microsoft's security update addressing CVE-2025-33053.
## Lessons Learned
- **Key takeaways:** Stealth Falcon has significantly upgraded its toolkit, shifting from older customized Apollo agents to the more advanced, evasive, and modular Horus toolset for espionage. Successful exploitation relied on a critical, unpatched zero-day in a core Windows feature (WebDAV).
- **What could have been done better:** Proactive defense against zero-day exploitation, especially restricting non-standard use of protocols like WebDAV or ensuring rapid patching cycles.
## Recommendations
- Immediately apply the latest Windows updates released by Microsoft to patch **CVE-2025-33053**.
- If immediate upgrading is not possible, implement network controls to **block or closely monitor all outbound WebDAV traffic** directed towards untrusted external or internal endpoints.