Attackers testing like a product team

The open directory exposed the attacker’s payloads and testing process. The collection varied by function: some folders stored payloads, while others isolated individual delivery methods, including WebDAV, UNC paths, search-ms, library-ms, Control Panel items, and trusted Windows binaries. Several directories appeared to be QA areas for testing how lures are rendered in browsers and Windows Explorer. These tests included Unicode spoofing, right-to-left override (RTLO) characters, double extensions, and padding tricks used to make executables look like documents. The directory also contained several README files.

Their structure and phrasing suggested they may have been generated with LLMs. Some folders were named testik and testik2, a Russian diminutive form of “test”. Figure 1: Snippet of one of many subfolders containing testing files. Looking at the artifacts from the open directory, we saw that the attacker was testing some specific CVEs. CVEObserved samplesShort descriptionCVE-2025-3305311Windows Internet Shortcut flaw involving external control of a file name or path, allowing code execution over a network.

(nvd. nist. gov)CVE-2026-215134MSHTML Framework security feature bypass caused by protection-mechanism failure. (nvd. nist.

gov)CVE-2025-240541Windows NTLM spoofing issue where crafted file/path handling can trigger outbound authentication and leak NTLM material; observed tradecraft commonly involved . library-ms files. (nvd. nist. gov) Table 2: CVE references observed in the exposed directory.

The most developed test set focused on CVE-2025-33053, the working-directory abuse technique reported by Check Point in its analysis of Stealth Falcon activity. It appears as though the threat was trying to reproduce or adapt the reported technique with the help from README that appears to have been generated with LLMs. At a high level, the technique abuses .