Exposed server reveals DoNot toolkit targeting Pakistan sectors

Security researchers exposed an unsecured staging server hosting a DoNot APT toolkit aimed at Pakistan’s nuclear, power, ICS, and energy sectors. The server, exposed in October 2026, contained 48 files totalling around 12 MB on a French M247 host. Investigators say the scripts include hardcoded references to PAEC, Chashma, KANUPP, SCADA, and Modbus, and describe reconnaissance against the ELECTRICAL user and materials in the wallet and public music directories.

The attackers used batch scripts to check PowerShell versions and folder permissions, and a go.bat payload used a bundled curl to fetch additional payloads.

The toolkit employs multiple reverse shells and three Go executables (rvb80_232.exe, rvb61135.exe, rvb_new.exe) that connected to 179.43.145[.]232 and 193.29.104[.]84, with operators later stripping symbols and enabling TLS. A custom HTTP implant named Beacon-trydnd1.exe and a Metasploit loader rv88b.exe were present. Inveigh was used to poison LLMNR, NBNS, and mDNS to harvest NetNTLM hashes, with updates to impersonate Oil and Gas Development Company Limited (OGDCL) via domain spoofing.

The activity is linked to APT-C-35 with medium‑to‑high confidence, based on telemetry such as a tcptest.ps1 pinging a C2 at 31.7.61[.]8:443 and prior reporting tying the group to Pakistani targets. Data collection and lateral movement focused on the ELECTRICAL user’s documents, history, and recent files, including 15 specific keywords. The report notes a plaintext credential in ad_pwd.txt and probing of C$ shares across 192.168.6[.]0/24.

Defenders are urged to disable LLMNR/NBNS, block outbound connections to listed IPs and domain, and monitor for files in %USERPROFILE%\\Wallet\\Hunrd\\ or %PUBLIC%\\Music\\.