Exposed WebDAV Server Functions as AI-Powered Malware Delivery Lab
Researchers uncover an exposed WebDAV server meticulously engineered as a malware delivery lab, complete with AI-generated lures and automated testing, signaling an accelerated attacker development cycle.
An exposed WebDAV server has been discovered operating as a sophisticated malware delivery lab, a finding that sheds light on an evolving and accelerated attacker development cycle. Security researchers from Rapid7 identified the infrastructure, which hosted over 1,000 artifacts, and observed its use as a comprehensive testing ground for delivery paths, social engineering lures, and execution methods. The analysis suggests a shift towards attackers adopting practices akin to modern software product teams, leveraging generative AI to rapidly create and test malicious payloads.
The investigation began with a routine MDR alert triggered by a user executing a file from a WebDAV server using rundll32.exe. Further telemetry indicated the WebClient service initiating contact with a remote host to retrieve content. This initial lead prompted a deeper dive, revealing an exposed directory that was far more than a simple file repository. It served as an active hub for malware testing and delivery, containing not only payloads but also bulk-generated shortcut lures, URL-based execution tests, ClickFix pages, WebDAV initialization scripts, droppers, spoofed filenames, and operator notes.
A detailed breakdown of the 1,048 files found on the server highlights the diverse functionalities of this lab. A significant portion, 453 files, were LNK delivery launchers, featuring bulk-generated shortcut lures designed with document themes, spoofed filenames, fake icons, and multiple execution paths. Another 236 files were dedicated to filename-spoofing QA, testing techniques like Unicode, double-extension, and padding tricks to deceive users and security software. Additionally, 146 files were URL/LOLBin execution tests, experimenting with signed Windows binaries and WebDAV-style execution, while 89 files were encrypted droppers, staging second-stage payloads.
The technical analysis revealed that attackers were systematically testing specific vulnerabilities, including CVE-2025-33053, CVE-2026-215134, and CVE-2025-24054. The most developed test set focused on CVE-2025-33053, a Windows Internet Shortcut flaw that allows code execution over a network by abusing the working directory. The threat actor appeared to be replicating or adapting techniques reported by other researchers, using README files that strongly suggested AI generation. These notes detailed the abuse of .url shortcut behavior to launch legitimate signed Windows binaries while directing their working directory to an attacker-controlled WebDAV share.
Evidence of generative AI use was particularly strong in the README files found within the directory. Their structure and phrasing indicated they may have been generated by Large Language Models (LLMs). Some folders were even named using Russian diminutives for "test," such as "testik" and "testik2." This suggests a move towards automated content generation for documentation and potentially for crafting more convincing social engineering lures, significantly speeding up the malware development lifecycle.
This discovery underscores the critical importance of unified security strategies that combine exposure management with detection and response capabilities. By identifying this exposed infrastructure, security teams gained visibility not just into a single campaign, but into the entire attack pipeline. The findings demonstrate an accelerated attacker workflow, moving beyond individual exploit development to a more product-like approach where rapid iteration and testing are paramount.
The implications of this AI-assisted, product-like development cycle are significant. Attackers can now more efficiently test and refine their tools, lures, and delivery mechanisms, potentially leading to more sophisticated and harder-to-detect threats. The systematic approach observed in this WebDAV lab highlights the need for organizations to continuously monitor their external attack surface and implement robust defenses against evolving social engineering and malware delivery techniques.
This new report details how the exposed WebDAV server revealed not only the AI-assisted phishing toolkit but also captured the operation mid-build, including testing notes, failed experiments, and live delivery logs. It further elaborates on the operator's use of generative AI to produce and test phishing delivery, specifically focusing on reproducing the CVE-2025-33053 WebDAV hijack against newer Windows versions by testing alternative signed binaries.