Exposed Opendir Reveals APT DONOT Cyber Espionage Toolkit Targeting Pakistan's Nuclear and Energy Sectors

An exposed Open Directory hosted at 193.29.104[.]84:8099 has revealed a collection of tools and scripts potentially associated with an intrusion targeting Pakistan's strategic sectors. The scripts contain hardcoded references to Pakistan's nuclear infrastructure, power sector, and industrial control systems (ICS), including PAEC, Chashma, KANUPP, SCADA, and Modbus.

Using VirusTotal and StrikeReady post, the investigation draws a connection to DoNot APT (APT-C-35), adding a significant dimension to the investigation.

This research examines the exposed toolkit, its development timeline, associated infrastructure, execution capabilities, and targeting indicators to assess the nature and possible objectives of the activity.

Key Findings

• Pakistan-focused reconnaissance: Recovered scripts contain references to PAEC, Chashma, KANUPP, SCADA, Modbus, and other strategic-sector terminology.
• Credential harvesting: Multiple Inveigh configurations demonstrate attempts to capture NetNTLM hashes through LLMNR, NBNS, and mDNS poisoning.
• OGDCL impersonation: Some scripts modify domain-related environment variables to impersonate OGDCL.
• Internal reconnaissance and lateral movement: Scripts enumerate user profiles, search for potentially sensitive documents, map internal networks, and test credentials against administrative shares.
• Continued toolkit development: Changes observed between October 9 and October 14, 2026, indicate that the exposed collection evolved over several days.

Infrastructure Details

The IP address 193.29.104[.]84 is hosted on the network of M247 Europe SRL (AS9009). According to Hunt.io↗ (opens in a new tab), the IP belongs to the 193.29.104.0/24 network and is geolocated to Saint-Denis, Île-de-France, France.

An examination of the exposed directory revealed 48 files totaling about 12 MB, with no subdirectories.

The interesting part was the reconnaissance scripts, which revealed clues about the actor’s targets through hardcoded paths and keyword searches.

Evolution of the Exposed Staging Infrastructure

The earliest identified files in the exposed collection date to October 9, 2026, with an initial batch of 34 files. The additional files appeared over the following days, including a plaintext credential, updated reverse shells, and modified Inveigh configurations.

The most notable changes are summarized below.

The October 10 upload of ad_pwd.txt suggests possible credential exposure, although its origin and operational use remain unconfirmed. The October 14 files reference OGDCL spoofing in the Inveigh configurations. It highlights continued development of the toolkit several days after the initial upload, indicating continued development of configurations for LLMNR/NBNS poisoning.

Targeting Indicators: Pakistan's Nuclear, Energy, and ICS Infrastructure

The analysis of the recovered batch scripts revealed references to Pakistan’s nuclear infrastructure, power grid, and industrial control systems.

contenthunt.bat searches user files for keywords such as PAEC, Chashma, KANUPP, SCADA, and Modbus, while hunt88.bat checks browser-related artifacts and other system locations for additional information. A third script, invgo2.bat, configures the environment to impersonate OGDCL before launching Inveigh.

Note: These findings suggest a focused interest in Pakistan’s nuclear and energy sectors, although the scripts alone do not confirm the identity of the victim organization or the actor’s ultimate objective.

Inside the Attacker's Toolkit

Remote Access and Reverse-Shell Capabilities

The actor used multiple scripts to establish and maintain reverse-shell access. rev.ps1 and revcmd.ps1 connect to 179.43.145[.]232:61135, while rev106.ps1 connects to the staging server at 193.29.104[.]84:45600. The tcptest.ps1 and t.ps1 scripts check connectivity to these endpoints and the additional address 31.7.61[.]8:443. Batch files repeatedly relaunch payloads, with rv88b.bat downloading the executable again on each iteration.

Credential Harvesting with Inveigh

A substantial portion of the toolkit focuses on credential capture using Inveigh↗ (opens in a new tab), a PowerShell tool that poisons LLMNR/NBNS/mDNS responses to capture NetNTLM credential hashes from hosts on the same network segment.

The actor went through at least ten iterations of Inveigh configurations across the operation. Early scripts (inv3.ps1 through inv10.ps1) tested different combinations of protocols, output directories, and verbosity levels.

inv12.ps1 represents the most sophisticated approach: it launches Inveigh inside a hidden child PowerShell process with all stdio redirected, making it invisible to any user watching the screen.

It writes the child PID to C:\inv12pid.txt so the operator can kill it cleanly later.

inv8.ps1 and inv9.ps1 spoof environment variables before running Inveigh to make it appear as a workgroup machine:

1$env:USERDOMAIN = "WORKGROUP"
2$env:USERDNSDOMAIN = "workgroup.local"

The later batch files (invgo2.bat, tinv2.bat, tinv3.bat) switched from WORKGROUP to spoofing OGDCL specifically, which is more convincing on a network where OGDCL machines are expected to be present.

Host and Network Reconnaissance

recon88.bat runs four commands (arp -a, route print, net share, and nbtstat -S) and appends everything to C:\Windows\Temp\recon88.txt.

hunt88.bat and hunt88b.bat both focus entirely on the ELECTRICAL user account. hunt88b.bat walks the user's entire profile, collecting directory listings from Recent files, Desktop, Documents, Chrome user data, browser history, and network shortcuts. hunt88.bat adds keyword searches on top of that, specifically looking for nuclear and ICS-related content in those same locations.

contenthunt.bat searches every file in C:\Users\ELECTRICAL\Documents\ for the 15 keywords listed earlier and writes matching filenames to C:\Windows\Temp\contenthunt.txt. The script appears designed to identify potentially sensitive documents for subsequent collection.

Lateral Movement

lantest.bat cycles through 30 hosts on 192.168.6.0/24 and attempts to connect to C$ using three credential sets. All output goes to C:\Windows\Temp\lantest.txt.

C2 Infrastructure and Executable Functionality

Seven executable files were identified, comprising five potentially malicious tools and two legitimate curl binaries. The five executables found in the opendir break into three categories.

• rvb80_232.exe, rvb61135.exe, and rvb_new.exe are Go reverse shells compiled weeks apart, each one incrementally more hardened than the last.
• Beacon-trydnd1.exe is a custom HTTP C2 implant.
• rv88b.exe is a minimal loader wrapping a stock Metasploit x64 payload.
• curl_x64.exe and curl_x86.exe are clean curl 7.40.0-DEV binaries and are not covered here.

After analysis with IDA Pro, I summarise the identified executable groups, their C2 infrastructure, and their primary functionality as shown below:

The Go-based reverse shells (rvb80_232.exe, rvb61135.exe, and rvb_new.exe) establish outbound connections to 179.43.145[.]232 (ports 80 and 61135) and 193.29.104[.]84 (port 45600), providing remote command execution through cmd.exe. After analysis, a progression in the attacker’s tooling, with symbol stripping introduced in the second sample and TLS encryption and a change in C2 infrastructure observed in the third, was found.

The Beacon-trydnd1.exe implant communicates with 179.43.145[.]232 through HTTP polling, retrieves commands from HTTP response headers, and supports process injection.

In contrast, rv88b.exe functions as a Metasploit x64 shellcode loader, executing a reverse shell payload that provides remote command execution.

The following table provides a consolidated comparison of all identified executables:

Attribution Assessment: Indicators Linking the Activity to DoNot APT (APT-C-35)

The investigation identified a significant potential connection between the exposed infrastructure and activity associated with DoNot APT (also tracked as APT-C-35 and SectorE02).

The third C2 IP, 31.7.61[.]8 (port 443, used in tcptest.ps1), resolves to pakdw.orchidheaven.online in VirusTotal passive DNS↗ (opens in a new tab) as of September 18, 2025.

The same domain was referenced in a StrikeReady Labs post↗ (opens in a new tab) discussing an India-linked APT campaign, which also identified a malicious PowerPoint document named File Copy.ppt (SHA-256: bfaec98e7fdcf93c1bce3cc592f29e098e1facef0387cdccf8b0d7e5fa87c5ee).

The analysis of the mentioned file on VirusTotal is given below:

The file File Copy.ppt behavior maps directly onto documented DoNot macro techniques:

The %PUBLIC%\Music\ staging path is a specific DoNot fingerprint. The QianXin Heavy Shadows report↗ (opens in a new tab) on recent DoNot techniques lists C:\Users\Public\Music\aco explicitly as a DoNot staging directory alongside C:\Users\Public\Videos\nota. That same report confirms DoNot's use of macro-released batch files running schtasks commands, matching the yfda/mxfd task creation in the PPT lure.

Pakistan nuclear and energy sector targeting is consistent with DoNot's documented focus on South Asian government and defense organizations, including prior Pakistani campaigns documented by Rewterz↗ (opens in a new tab) (APT-C-35 targeting Pakistani official organizations) and Cyble↗ (opens in a new tab) (DoNot targeting Pakistan's defense manufacturing sector).

These connections strongly pointed to APT DoNot Group.

Conclusion

The operation follows a straightforward playbook once initial access was achieved on the ELECTRICAL account.

First, environment checks. tp.bat verifies PowerShell execution and retrieves the username and PS version. tcptest.ps1 confirms which C2 endpoints are reachable. ptest.bat checks that C:\Windows\Temp and C:\loot are writable.

Second, payload staging. go.bat uses the bundled curl to download Inveigh and the initial Inveigh wrapper from the staging server into %USERPROFILE%\Wallet\Hunrd\. This directory is used as the persistent local toolkit location throughout the campaign.

Third, shells. Multiple reverse shell paths run in parallel loops: the PowerShell variants connecting to 179.43.145[.]232:61135 and the Go binary connecting to 179.43.145[.]232:80.

Fourth, recon. recon88.bat maps the network. hunt88.bat and hunt88b.bat catalog the ELECTRICAL user's files. contenthunt.bat searches for nuclear and ICS documents.

Fifth, credential harvesting. Inveigh runs on the local network segment, poisoning LLMNR/NBNS/mDNS queries and capturing NetNTLM hashes from other machines. The October 14 addition of OGDCL domain spoofing shows the actor refining this step to be more convincing.

Sixth, lateral movement. lantest.bat tries the harvested credentials against 30 hosts on 192.168.6.0/24.

The infrastructure correlation and similarities to publicly documented DoNot APT tradecraft provide a credible basis for assessing a potential APT-C-35 connection.

MITRE ATT&CK

Indicators of Compromise

Network

Host Artifacts

File Hashes (SHA-256)