Exposed WebDAV Malware Lab Reveals AI-Driven Delivery Pipeline

Executive Summary

A single MDR alert led Rapid7 analysts to an exposed WebDAV server that was not merely hosting malware payloads but operating as a fully functional malware delivery laboratory. The server contained over 1,000 artifacts — including bulk-generated shortcut lures, WebDAV initialization scripts, ClickFix HTML pages, and encrypted droppers — revealing an adversary systematically testing delivery paths, social engineering lures, and execution methods. Critically, the infrastructure showed signs of generative AI adoption: README files and test documentation exhibited phrasing consistent with LLM output, and the operator structured folders as QA environments for different delivery techniques. This discovery, published by Rapid7 on July 21, 2026, provides defenders with an unprecedented view into how modern threat actors are industrializing malware delivery.

Technical Analysis

From Alert to Infrastructure Discovery

The investigation began when a user executed a file retrieved from a WebDAV server via rundll32.exe. Telemetry showed the WebClient service starting, followed by davclnt.dll connecting to a remote host. That single hit led Rapid7 to an exposed directory on the same server, which contained 1,048 files organized into functional categories.

Artifact Breakdown

The recovered files clustered into 11 categories, according to Rapid7's analysis:

• LNK delivery launchers (453 files): Bulk-generated shortcut lures using document themes, spoofed filenames, fake icons, and multiple execution paths.
• Filename-spoofing QA (236 files): Tests for Unicode characters, double extensions, padding tricks, and browser/Explorer rendering behavior.
• URL/LOLBin execution tests (146 files): Experiments with signed Windows binaries, remote working directories, and WebDAV-style execution.
• Encrypted droppers (89 files): Staged second-stage payloads and installer-style packages.
• Alternative execution containers (24 files): search-ms, library-ms, .cpl, and related delivery containers.
• Payload stubs and spoofed executables (21 files): Smaller loaders, decoys, and renamed binaries.
• WebDAV scripts (17 files): Scripts intended to make WebDAV delivery more reliable on Windows systems.
• Builder and operator notes (10 files): README files, test reports, mappings, and generation scripts.
• ClickFix HTML lures (9 files): Browser-based social-engineering pages instructing users to run commands.
• Miscellaneous files (6 files): Included documentation for the actor's WebDAV delivery/admin panel.

CVE-Specific Testing

The directory contained artifacts testing three specific CVEs, with the most developed set focused on CVE-2025-33053 (11 samples observed), a Windows Internet Shortcut flaw involving external control of a file name or path that allows code execution over a network. The attacker also tested CVE-2026-21513 (4 samples), an MSHTML Framework security feature bypass, and CVE-2025-24054 (1 sample), a Windows NTLM spoofing issue.

According to Rapid7, the CVE-2025-33053 tests closely mirrored a technique reported by Check Point in its analysis of Stealth Falcon activity. The technique abuses .url shortcut behavior to launch a legitimate signed Windows binary (iediagcmd.exe) while setting its working directory to an attacker-controlled WebDAV share. When invoked, the utility launches child processes by name; if the working directory points to a remote WebDAV location, Windows may resolve those child process names from the remote share instead of the expected local system directory.

AI-Assisted Development

The README files found in the directory exhibited structure and phrasing consistent with LLM generation, Rapid7 noted. Some folders were named testik and testik2 — a Russian diminutive form of "test." The README files for the CVE-2025-33053 tests called out iediagcmd.exe as the preferred binary, referenced the same WebDAV working-directory pattern described in the Stealth Falcon reporting, and preserved the previously reported summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr path as an example.

Attacker Workflow

The directory structure revealed an operator working like a software product team. Separate folders isolated individual delivery methods: WebDAV, UNC paths, search-ms, library-ms, Control Panel items, and trusted Windows binaries. Several directories appeared to be QA areas for testing how lures render in browsers and Windows Explorer, including Unicode spoofing, right-to-left override (RTLO) characters, double extensions, and padding tricks.

Mitigations & Recommendations

Defenders should monitor for WebDAV-related telemetry, specifically the WebClient service starting followed by davclnt.dll connections to external hosts. Organizations should restrict outbound WebDAV access where not business-required and audit .url, .library-ms, and .search-ms file executions. The use of signed Windows binaries like iediagcmd.exe with non-standard working directories should trigger investigation. Rapid7 recommends unifying exposure management with detection and response to gain visibility into attacker delivery pipelines rather than individual campaigns.