AI-Assembled Cyber Crew Exposes Its Own Work After Hacking Spanish SMBs

Overview

A sophisticated threat actor operating under the alias Operation Open Ledger has inadvertently exposed its entire hacking infrastructure after targeting small and medium-sized enterprises (SMBs) in Spain. By leaving a server open to the public internet, the crew revealed over 10,000 files that detail a highly organized, AI-assisted campaign. The operation focused on stealing sensitive enterprise data from ten Spanish businesses, utilizing a blend of custom-developed tools and borrowed proof-of-concept exploits.

The exposed directory, hosted on 89.124.67.72, contained everything from shell histories and active directory arsenals to the actual stolen loot. Investigators recovered approximately 15 GB of data, which included full ERP tenant dumps, payment card numbers, IBANs, and health records. The operator appears to have used an AI agent called opencode to assemble and manage their toolkit, resulting in a polyglot mixture of English, Russian, and Chinese documentation.

Discovery and Infrastructure

Security researchers identified the exposed server by hunting for malicious open directories within high-risk hosting environments. The host, registered to SERVERS TECH FZCO with AS216071 in the Netherlands, was flagged because its HTTP directory listing unambiguously displayed offensive tooling alongside bulk ERP exports. This unusual combination of elements, such as Sliver C2 artifacts next to stolen business data, prompted a full harvest of the directory.

The investigation recovered 10,428 files spanning the operator's entire working tree. Automated classification extracted secrets, victim identifiers, and language markers, providing a comprehensive dossier of the attack. Sensor history indicates the server was active between late September and early October 2026. The breadth of the exposure allowed analysts to reconstruct the attacker's methods, tools, and targets without needing direct access to the victims' networks.

Attack Methodology and Exfiltration Pipeline

The operation followed a two-pronged approach originating from the same working directory. The first path targeted cloud-based vulnerabilities, while the second focused on on-premise enterprise appliances. The cloud path relied heavily on stealthy credential theft rather than traditional malware deployment. The attackers used gitleaks to scan a victim's public git repository, where they discovered an exposed Azure service principal secret.

Once credentials were obtained, the operator minted OAuth tokens using the standard client credentials grant. They then utilized the Microsoft Dynamics 365 Business Central REST API to bulk-dump tenant data. This process involved enumerating all companies within the tenant and systematically pulling customers, general ledger entries, and sales invoices. The operation was supported by a custom Python script and shell scripts, which were version-controlled up to v2.0.2.

The exfiltration was substantial, with a single export of general ledger entries reaching nearly 4 GB. This resulted in the complete financial system of each targeted business being compromised. Parallel to this, the intrusion path involved exploiting internet-facing appliances such as firewalls, load balancers, and mail servers. The crew possessed a six-product exploit kit covering vulnerabilities in SonicWall, JetBrains TeamCity, BeyondTrust, KEMP LoadMaster, and SmarterMail.

Arsenal and Implications

Beyond the targeted exploits, the operator maintained a full Active Directory arsenal comprising 24 offensive tools. This collection included industry-standard utilities such as mimikatz, secretsdump, DCSync, BloodHound, and impacket. The operator also deployed multiple command-and-control frameworks, including Sliver, Havoc, and Cobalt Strike, along with tunneling tools like chisel and ngrok. Additionally, an xmrig Monero miner was present, suggesting potential cryptocurrency theft or resource consumption as a secondary objective.

The tradecraft is distinctly AI-assembled, characterized by the use of the opencode agent to manage complex workflows. While the attacker did not author all the code, their ability to integrate diverse PoCs and automate the exfiltration pipeline demonstrates a high level of operational sophistication. The presence of a README crediting ChatGPT further highlights the integration of generative AI into modern cybercrime operations.

This incident serves as a critical reminder for organizations to audit their public-facing git repositories and cloud configurations. The ease with which the crew accessed Azure credentials underscores the importance of secret scanning and proper credential management. Furthermore, the exposure of the operator's entire toolkit on a public server highlights the risks associated with poor operational security, even among sophisticated threat actors.