GlobalProtect unleashed chaos

Article by Nacata Security, 28/09/2026

Can you imagine receiving a perfect bill from your electric company that it never actually issued?

That is exactly what happened between April and September 2026.

The attackers stole real customer data and used it to craft personalized invoices sent to individuals who had no reason whatsoever to be suspicious.

The operation combined a flaw in corporate VPNs with mass SQL injections, turning real debtor records into ammunition for an industrial-scale fraud campaign.

This is how a breach became a fraud factory.

SOCRadar researchers traced the operation, dubbed Operation Master, back to attacker-controlled servers. The entry point was CVE-2026-0257, a flaw in GlobalProtect that allowed VPN sessions to be created without valid credentials. The attackers scanned hundreds of millions of addresses, filtered out vulnerable gateways, and subjected them to an automated exploit loop, achieving confirmed access to seven gateways across four countries.

But getting in was only the beginning of the plan.

Once inside, they launched automated SQL injection attacks against at least nine database systems. On one of the billing servers they executed commands directly against the database and exfiltrated data through DNS requests with an unusual structure. In a single extraction they retrieved 24,558 debtor records. They also used AdaptixC2 to control two compromised Windows servers.

More than 2.4 million fraudulent messages fired off in just a few months.

With the data in hand, the attackers built a fraud panel that changed its appearance to impersonate different utility companies. They used twelve hijacked Microsoft 365 mailboxes and eight SMS gateways. Every message arrived personalized with the customer’s real data, giving any recipient solid grounds to pay without hesitation.

The infrastructure went down, but the threat did not.

In mid-September the visible infrastructure was taken offline, but researchers could not confirm whether the operation stopped or simply relocated. The already-stolen data continues to circulate, and the affected organizations still do not know with certainty which customers were targeted.

The fraud also came by phone.

In addition to emails and SMS messages with fake invoices, the attackers used device code phishing against corporate accounts and phone calls to obtain verification codes. These techniques are especially dangerous because the victim interacts with a real login screen or receives an apparently legitimate call, making it nearly impossible to distinguish them from an authentic process without prior training.

First they sold the stolen data, then they used it.

Researchers linked the operator to a profile that was selling stolen records from the energy sector on specialized forums. The same organizations appeared listed weeks before their data was loaded into the fraud campaigns. This reveals a double monetization strategy: first sell, then directly use those same records to pursue payments.

An invoice with your real data is almost impossible to ignore.

Some payment pages displayed the customer’s full name, address, and a visual copy of the original receipt. This eliminates most of the warning signs we would normally detect in a conventional fraud attempt.

How to protect yourself when you receive a suspicious invoice.

Before paying any invoice that arrives by email, SMS, or WhatsApp, verify it directly in your customer portal or call the number you already had saved—not the one shown in the message. If the company billing you has suffered a breach, also notify its customers so they remain alert.

Do not pay without verifying on your own.

The next invoice you receive with all your details correct could be the most dangerous one of all. Would you be able to tell it apart from a real one?

Would you recognize a fake invoice crafted using your own real data?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime