Network-Attached Sabotage: Inside a 343k-Host Credential Spill
During a routine asset and exposure hunting on the FOFA search engine, we identified an unsecured public directory containing clear-text credential dumps generated by an ongoing, mass-scale brute-forcing campaign.
The repository contains approximately 343,000 unique host records, complete with IPv4 addresses, access ports, usernames, and plain-text passwords.
The targeting heavily focuses on NAS devices (Network-Attached Storage) and exposed remote management interfaces (RDP, admin panels, etc..)
The credentials in the dump confirm that the threat actors did not need sophisticated zero-days or complex exploits. The vast majority of breaches succeeded due to basic credentials hygiene failues:
- Default factory combinations: admin:admin, root:root
- Sequential/trivial passwords: admin:123456, admin:password, user:12345678
And despite years of vendors warnings and automated prompts urging users to change default passwords, hundreds of thousands of internet exposed appliances continue to operate using out-of-the-box credentials.
Date timestamps indicate the campaign has been active from late 2025 through mid 2026, and notably, about ~38% (~130,000 hosts) if the compromised infrastructure is located within the Russian Federation, with remaining exposures distributed globally across Europe, the Americas, Asia, and Africa.
Enterprise and corporate networks are confirmed among the affected endpoints, presenting severe risks of initial access brokering, corporate network infiltration, and secondary ransomware deployment.
Why does a list of 343K NAS logins matter? well in the modern cybercrime economy, credential dumps like this rarely stay dormant, they feed directly into the IAB (Initial Access Broker) ecosystem.
The exposed database functions as an initial access list, threat actors routinely trade, sell or leak these repositories on underground forums, allowing low-tier actors immediate entry into private networks, an illustrative example of a known Initial Access Broker:
For compromised devices residing inside enterprise networks, an administrative compromise of a NAS system provides an immediate staging point for domain enumeration, privilege escalation, and network-wide data encryption, not only that, NAS devices traditionally host raw file backups, critical corporate documents, intellectual property and personal data, enabling direct exfiltration without needing further internal pivot.
Below is the structured attack progression observed from initial scan to final objective:
We assume this credential dump was produced using the following steps:
It starts with reconnaissance, high speed internet sweeps isolating open web-management ports (8080, 5000, 443). then moves on to credential spraying and testing high-frequency default logins (admin:123456), harvesting valid hits into a cleartext staging CSVs
The later stages are either automated payload execution -> local volume encryption (e.g., Deadbolt, Qlocker) or direct file exfiltration -> extortion note dropped on admin homepage
Or credential harvesting -> SOCKS proxy established -> internal network discovery -> lateral movement to domain controllers -> multi-system ransomware deployment.
| Tactic | Technique ID | Technique Name | Observation |
|---|---|---|---|
| Reconnaissance | T1595.001 | Active Scanning: Scanning IP Blocks | Sweeping public IP ranges for exposed NAS web interfaces |
| Reconnaissance | T1596.005 | Search Open Technical Databases | Initial discovery of staging data via FOFA engine |
| Initial Access | T1133 | External Remote Services | Remote login to administrative interfaces via WAN |
| Credential Access | T1110.001 | Brute Force: Password Guessing | Automated testing of dictionary credentials |
| Credential Access | T1110.003 | Brute Force: Password Spraying | Mass testing single password variants across thousands of endpoints |
| Credential Access | T1552 | Unsecured Credentials | Staging validated cleartext credentials on open web servers |
If your organization utilizes NAS appliances or perimeter management interfaces, we highly recommend to never exposed management portals directly to the internet, administrative interfaces (port 5000/5001, 8080, RDP, SSH) should never be directly reachable via WAN.
- Use an encrypted VPN with MFA or a Zero Trust Network Access (ZTNA) tunnel, disable default admin accounts and generate new ones with strong, unique passphrases.
- Enable MFA and require TOTP or hardware keys on all web login interfaces.
- Keep your firmware updated to regularly patch remote exploitation vulnerabilities that bypass login pages entirely.
- Audit active directory service accounts, ensuring backup and NAS management service accounts adhere to the principle of least privilege.
Disclosure Note: our research team has not authenticated against or accessed any host listed in the exposed dataset, the raw credential dataset remains securely contained internally for threat intelligence and victim notification purposes.
