Viva Aerobus-Linked Attacker Infrastructure and Post-Exploitation Findings

During threat-hunting activities conducted by the ThreatMon Threat Intelligence Team, an exposed attacker-controlled staging/loot server was identified. The server contained tooling prepared to access Microsoft SQL Server environments, execute Windows commands and encoded PowerShell through xp_cmdshell, upload and retrieve files, perform credential harvesting, collect DPAPI material, and conduct credential-reuse attempts against additional SQL and SMB targets.

HTTP activity and recovered tooling were found to support a post-exploitation sequence involving a victim-side MSSQL system, command execution, credential collection, recovery of SSMS connection metadata, and preparation for lateral movement. Source-code and configuration artifacts containing SQL, OAuth, mail, and SFTP-related material were also present within the exposed loot set.

This public version has been intentionally sanitized. Victim-specific IP addresses, internal hostnames, user identities, credential material, OAuth identifiers, partnerspecific configuration, and other details that could unnecessarily increase exposure have been withheld.