Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe

    Friday, November 13, 2026 In: Threat Research Print

    Date: 11/13/2026

    Severity: High

    Summary

    DarkLunnen is a previously unidentified threat actor whose exposed server revealed more than 14 months of cyber operations targeting European organizations. The investigation uncovered attempts to exploit FortiGate firewalls, brute-force VNC services, target vulnerable Hikvision cameras, and access Exchange servers. The operator also obtained stolen VPN credentials from a Romanian organization's firewall configuration and targeted Ukrainian defense and aviation sectors. Although several activities indicate potential compromises, not all attacks were confirmed successful. 

    Indicators of Compromise (IOC) List

    Domains/URLs

    129.146.87.174

    46.8.236.121

    Hash

    d9edfa7e57067b0a175577e511a9a7ac3d885d15ce28080fa779203317f7616a

    e15780896245c5f8cbff9303a517e782e94e20f39bb87221a5cb1faac5372c07

    0b65f60dc4ace2506003e18bf3ce4a25a149473b57c18af22167afc7037da3bb

    27ddcf81362f87d865329e07235e950fb69ed175afa1f71f76ccfd24ef50fb46

    61e706f5606e025ae8c85a8d1fe7096e0418e16d66acab75b009704d5529a94b

    b8a76bd31984c13d2b0a47d2aaf68e7472d24f6e63575d1feb2fe50956c32acb

    8a43a9c335d9dfe642a0fc5082800753f5ed450fb13b4823cae17e3d0a5bfa1f

    3732b1ffd1a28cf0cc35532bcbea7c179928b8aaa20b16684cd0255ad0f075d1

    482d16f6c2fa15c10cfc46e37cb298ccee3da1c1ac058a045166fa1429aeb8f7

    c7a1e7f8c81e5deb8e63132e942a56aa88acfddabb14ef10141b5c950477b61e

    c2a37e9f628d7bfe2e8403c451120f314ef65edb1fde1ab83444714fce85d787

    ce8faad7a4074429d532a39dfd4aedd3afaf1145a3c8c89d2060fc7d8de5d598

    8c6969152a0e1ac530909d426797b8326c755ac174a354b67a25f0d0e50b87fa

    97826498e0bdebb04d6372a8aae3f86a63d22aeadd6edf15ae2931b037e21958

    5ebceb30834144677c09faf41fa238d1e1eabbb60a4e565c43a337f02381aed9

    73624b493febe5af0b9f5893adc2ae41c6b09bf1bf2e6fc05ab3a5908b9a7a2a

    05f6e90c037205bf230a1784b0df09a49bc99ccca7643284e290c58679760ab2

    5c65130964db07a2a3fa86b809430aec3ec61d49678349ec693e1ef39cd10b97

    6a619a8710badffadead19d75d6aaf4db0d477282fbf44553a36bf7bc83c3a0c

    52e85a33f216ce6e258d82eb7fa79c2bfdb3b7479751571b6c225884a61a10e8

    d3d6c5c91d856abfcd3dc05a33d7f602b2c59c7a6950c1b641edeee88793600e

    ffee49eed5f8095e30b124eaeaa1ff5e925e3ebd9f85ed1252abfbedd42dbbd2

    dcec7e94a3a76f9f233bcfbb3e7b37b1bb869c1871a4bb29141db3e09344a8f8

    73bc1226e3fafaab0189adb293bbd9a9a1bbfd8d6e68e4ad8efc309d59aaa050

    02575593e5259f5ba22d524d1fefd71d56d60d0e49d2597333cd4de83ccac9a8

    2abc95ce81460a1f018a3ad97a82b4cf201ad1944f2e6fa5a625f301c48b54b7

    57220bac36ac74a003ac09a4c1b6248b43ad10cae2cde4019ceb3144abf6879c

    5e36c5b3c592172d46d1fc73ab594611c2f8fb600a18f4bd33dbf5719313a00e

    19b00abb2caa589b8d2d5cd4816be65e5f456e0c7edbccf17df8fc17dd97cbfe

    bc7870c02f5d74828064a0d08a275e927ca205a85e847ed4f48cc4b45bc87b3c

    CVE Ids

    CVE-2017-7921

    CVE-2022-1040

    CVE-2022-36883

    CVE-2022-47986

    CVE-2023-46747

    CVE-2024-4577

    CVE-2024-55591

    CVE-2025-24071

    CVE-2025-25257

    CVE-2025-31324

    CVE-2025-48703

    CVE-2025-48827

    CVE-2025-49113

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    dstipaddress IN ("129.146.87.174","46.8.236.121") or srcipaddress IN ("129.146.87.174","46.8.236.121")

    Detection Query 2 :

    sha256hash IN ("d3d6c5c91d856abfcd3dc05a33d7f602b2c59c7a6950c1b641edeee88793600e","d9edfa7e57067b0a175577e511a9a7ac3d885d15ce28080fa779203317f7616a","e15780896245c5f8cbff9303a517e782e94e20f39bb87221a5cb1faac5372c07","0b65f60dc4ace2506003e18bf3ce4a25a149473b57c18af22167afc7037da3bb","27ddcf81362f87d865329e07235e950fb69ed175afa1f71f76ccfd24ef50fb46","61e706f5606e025ae8c85a8d1fe7096e0418e16d66acab75b009704d5529a94b","b8a76bd31984c13d2b0a47d2aaf68e7472d24f6e63575d1feb2fe50956c32acb","8a43a9c335d9dfe642a0fc5082800753f5ed450fb13b4823cae17e3d0a5bfa1f","3732b1ffd1a28cf0cc35532bcbea7c179928b8aaa20b16684cd0255ad0f075d1","482d16f6c2fa15c10cfc46e37cb298ccee3da1c1ac058a045166fa1429aeb8f7","c7a1e7f8c81e5deb8e63132e942a56aa88acfddabb14ef10141b5c950477b61e","c2a37e9f628d7bfe2e8403c451120f314ef65edb1fde1ab83444714fce85d787","ce8faad7a4074429d532a39dfd4aedd3afaf1145a3c8c89d2060fc7d8de5d598","8c6969152a0e1ac530909d426797b8326c755ac174a354b67a25f0d0e50b87fa","97826498e0bdebb04d6372a8aae3f86a63d22aeadd6edf15ae2931b037e21958","5ebceb30834144677c09faf41fa238d1e1eabbb60a4e565c43a337f02381aed9","73624b493febe5af0b9f5893adc2ae41c6b09bf1bf2e6fc05ab3a5908b9a7a2a","05f6e90c037205bf230a1784b0df09a49bc99ccca7643284e290c58679760ab2","5c65130964db07a2a3fa86b809430aec3ec61d49678349ec693e1ef39cd10b97","6a619a8710badffadead19d75d6aaf4db0d477282fbf44553a36bf7bc83c3a0c","52e85a33f216ce6e258d82eb7fa79c2bfdb3b7479751571b6c225884a61a10e8","ffee49eed5f8095e30b124eaeaa1ff5e925e3ebd9f85ed1252abfbedd42dbbd2","dcec7e94a3a76f9f233bcfbb3e7b37b1bb869c1871a4bb29141db3e09344a8f8","73bc1226e3fafaab0189adb293bbd9a9a1bbfd8d6e68e4ad8efc309d59aaa050","02575593e5259f5ba22d524d1fefd71d56d60d0e49d2597333cd4de83ccac9a8","2abc95ce81460a1f018a3ad97a82b4cf201ad1944f2e6fa5a625f301c48b54b7","57220bac36ac74a003ac09a4c1b6248b43ad10cae2cde4019ceb3144abf6879c","5e36c5b3c592172d46d1fc73ab594611c2f8fb600a18f4bd33dbf5719313a00e","19b00abb2caa589b8d2d5cd4816be65e5f456e0c7edbccf17df8fc17dd97cbfe","bc7870c02f5d74828064a0d08a275e927ca205a85e847ed4f48cc4b45bc87b3c")

    Reference:    

    Offensive Cyber Operations Targeting Europe                    


    Tags

    Threat ActorVulnerabilityEuropeCredential HarvestingUkraineDefense Industrial BaseTransportation SystemCVE-2017CVE-2022CVE-2023CVE-2024CVE-2025

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.