On July 28, 2026, someone posting as DXQRTXX told their own Telegram channel to tighten up their operational security. Weeks earlier, on the other side of that same channel, the crew had shared a report about a phishing operation that got caught out by a basic server misconfiguration leaving its internal files open on the public internet. They read it, reacted to it, moved on. Then their own server, holding a working credential vault, a custom C2 framework, and months of internal chat logs, turned out to have exactly the same problem.
This wasn’t a single leaked database or one malware sample pulled apart in a sandbox. It was closer to walking into somebody’s actual workshop: source code still being edited, a credential vault clearly in daily use, chat logs, target lists, even in-progress fraud scripts against a named list of French bank customers.
The centerpiece was GHOST C2 v6.0 a command-and-control framework the group wrote themselves in Go, roughly 13,000 lines split across modules for scanning, credential extraction, exploitation, and reverse-shell handling. Next to it sat a Python-based “Discovery Engine,” 17,826 lines, whose only job is to keep finding new targets. It queries Certificate Transparency logs for domains containing words like crypto, wallet, or exchange, checks passive DNS records tied to known crypto platforms, and brute-forces subdomains on a loop, every two minutes, feeding a scan queue built to hold over a million targets at once. This isn’t a script someone runs before bed and checks in the morning. It’s infrastructure meant to run unattended, indefinitely.
Alongside the code, a set of SQLite databases held the operational output: 16,415 credential records, reconnaissance results, exploitation logs, and financial notes tied to monetizing what they’d stolen. A Telegram export dated August 20 captured the group’s internal coordination in their own words.
Public directory listing observed on the exposed server. Internal directories and operational files were accessible without authentication. Sensitive infrastructure details have been partially redacted where appropriate.
DXQRTXX and Blackhatsect0r don’t appear to be doing the same job. DXQRTXX reads as the operator posts under that name reference specific IPs, dumped files, and live targeting, the kind of detail that comes from someone actually at the keyboard. Blackhatsect0r shows up more as an amplifier: forwarding DXQRTXX’s material, sharing outside security reporting, commenting on other groups’ breaches. One runs the operation; the other runs the megaphone.
They’re not alone, either. Names like ElPr0fessor999, KushSEC, and Whitwhy Dx surface throughout the chat logs ElPr0fessor999 was publicly credited for the toiles-et-voiles.fr breach, for instance. Compromised systems were tagged “HACKED BY THE DXQ SQUAD,” and internal messages refer to “our team.” Whatever the real structure behind the usernames, this reads as a small, coordinated crew rather than one person working alone.
The Telegram channel went live May 14, 2026. By May 17 three days in it was already distributing tooling and using phrases like “Next VICTIM,” which doesn’t read like a group finding its footing. It reads like a group that had already been doing this and had just opened a new storefront.
May 20 brought the first big public claim: a database dump from toiles-et-voiles.fr, credited to all three names. Five days later, on May 25, the channel posted personally identifiable information name, date of birth, home address belonging to someone the group described as tied to France’s Ministry of Justice. That’s a notable shift: from institutional data to a named individual’s personal details, for reasons the recovered material doesn’t fully explain.
By August, the channel had grown enough to poll its own audience on what to leak next. Company databases got 21 votes, “documents” got smaller numbers, and tools offensive scripts and frameworks, not stolen data took the top spot with 44. Read alongside the group’s growing habit of sharing things like a 62MB Cobalt Strike package, it points to a channel drifting from “here’s what we stole” toward “here’s what we can give you to steal your own.”
The targeting wasn’t random, but it also wasn’t narrow. Two patterns run through the data: broad automated scanning for anything valuable, layered under sustained manual effort against a short list of high-value systems once they’d been found.
The scanning side explains the scale 498,000 target URLs and 449 French government subdomains don’t get compiled by hand. They come from the Discovery Engine’s constant sweep of certificate logs and DNS records, which is also why crypto exchanges dominate the automated side of the target list: the engine is quite literally built to search for the word “wallet.”
The manual side explains the two operations ThreatMon dug into deepest. ANTAI France’s traffic-fine payment portal isn’t a crypto exchange and wasn’t caught by a keyword scan. Someone sat down, read the Angular frontend, and reverse-engineered its authentication logic by hand. Coinstable.io got the same treatment on the financial side: a working exchange with real user balances, worth the extra weeks of manual research a keyword search would never produce.
Both cases share the same underlying instinct read what the application sends to the browser, and treat all of it as fair game.
ANTAI. The team pulled apart the payment portal’s Angular JavaScript bundle and found three hardcoded cryptographic values sitting in plain sight: an AES initialization vector, a PBKDF2 salt, and a passphrase literally the French phrase troiscitronbosechatjouerbelierlawingssourisfermentpoids used to derive the same signing key the legitimate app used to mint authentication tokens. A script called ghost_token_forger.py used those constants to request valid tokens without ever supplying real credentials. From there the group tested JWT algorithm confusion (none, HS256, HS384) with administrative claims, probed HTTP request smuggling against an F5 BIG-IP load balancer sitting in front of the backend, and got as far as brute-forcing valid traffic-fine record IDs by combining French department codes with sequential numbers. A separate script bypassed the Worldline WAF entirely by sending POST requests with an X-HTTP-Method-Override header betting, correctly it seems, that the perimeter would inspect the outer method while the backend honored the override.
Coinstable.io. This one starts smaller and escalates faster. GHOST C2 found a .env file left readable on the exchange’s infrastructure, and inside it: a JWT signing secret set to the literal string secret. From that single value, a script called coinstable_admin.py forged an administrator token with is_admin, can_withdraw, and 2fa_verified all set to true, then paged through the platform’s entire user list via the admin API a thousand accounts at a time. A follow-up script, coinstable_drain.py, checked each account’s BTC, LTC, USDT, ETH, DOGE, and MATIC balances directly against the backend server rather than the public site, and prepared withdrawal requests routed to wallet addresses under the group’s control. Where a withdrawal needed email confirmation, a third script tried the obvious codes first 000000, 123456, 111111 before falling back to picking apart the frontend for an undocumented confirmation endpoint.
JWT_BLOB (ANTAI passphrase) troiscitronbosechatjouerbelierlawingssourisfermentpoids
JWT signing secret (Coinstable) “secret”
Coinstable backend (bypassing CDN) 212.27.13.112
F5-fronted backend (ANTAI) 90.102.74.9
Neither chain depended on a zero-day. ANTAI’s first stage exists because secrets that should only ever live on a server were shipped to every visitor’s browser. Coinstable’s admin-takeover chain exists because someone typed the word “secret” into a signing-key field and left it there in production. These are exactly the mistakes security teams are told to watch for and exactly the mistakes that, at scale, an automated crew with a 17,000-line discovery engine will eventually find.
The credential vault makes the stakes concrete. 16,415 records isn’t a curiosity it’s a working resource, split by type (databases, SMTP, cloud keys, GitHub tokens) so operators can pull exactly what they need for the next stage of an intrusion.
The detail that stands out most isn’t the tooling plenty of crews write their own scanners. It’s the contradiction sitting right there in the chat logs. On August 2, this same channel shared reporting about phishing infrastructure that got exposed through a basic HTTP misconfiguration. On July 28, DXQRTXX told the channel, in so many words, to stop being sloppy about OPSEC. And the server holding their own credential vault, source code, and months of internal chat was sitting open on the internet through that exact category of mistake, the entire time.
That’s not really a story about one crew’s carelessness. It’s a pattern ThreatMon sees often enough to name: offensive capability and defensive discipline don’t automatically travel together. A group can write a 13,000-line C2 framework and still leave a directory listing open to the world. The same asymmetry sits on the defender’s side of this report, too every technique documented here (frontend secrets, a hardcoded JWT key, an exposed .env file) is a known, well-understood class of mistake, not a novel attack. The organizations in this report weren’t beaten by something new. They were found by something automated, patient, and specifically built to notice what they’d left exposed.
That’s the practical argument for continuous external monitoring over periodic review. This group’s Discovery Engine runs every two minutes, forever. A quarterly security audit doesn’t stand a fair chance against that cadence the only real defense is watching your own exposed surface just as continuously as they’re scanning for it.
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
