50 Companies, One Password, Zero MFA: Lessons from the Zestix Campaign
Stolen Credentials, Terabytes of Data: Lessons Learned from the Zestix Campaign
The Zestix campaign exposed a serious weakness in corporate security that still deserves attention. Hudson Rock's Infostealers.com published an investigation showing how a threat actor known by the aliases "Zestix" and "Sentap" infiltrated the cloud file-sharing portals of approximately 50 large global companies. These attacks, spanning from aviation and defense to healthcare and energy infrastructure, brutally expose critical gaps in modern cybersecurity practices. This article examines the technical details of this campaign, the methods used by the attackers, and, most importantly, how organizations can protect themselves against such threats.
The Anatomy of Attack: Not Sophisticated, but Effective
The most striking aspect of the Zestix campaign is the lack of technical complexity in the methods used. This isn't about zero-day vulnerabilities, advanced persistent threats, or complex exploit chains. The basis of the attack is extremely simple: stolen credentials and incomplete multifactor authentication (MFA).
An employee unknowingly downloads a malicious file. This file contains one of the common infostealer families, such as RedLine, Lumma, or Vidar. The malware silently collects all passwords, cookies, and session information stored in the browser. This data is offered for sale on dark web marketplaces in packages called "logs."
This is where Zestix comes in. The threat actor scans these logs and extracts credentials for enterprise file-sharing platforms like ShareFile, Nextcloud, and OwnCloud. Then, using these username and password combinations, they log into the portals. Since MFA is not implemented, there are no obstacles in their way.
Perhaps the most disturbing finding of the report is this: some credentials had been sitting in the logs for years. Passwords hadn't been changed, sessions hadn't been invalidated. A password stolen from an infected device years ago was still valid today.
Targeted Platforms and Victims
Zestix targets platforms that are widely used in the corporate world: file synchronization and sharing solutions.
ShareFile (Progress Software): It is particularly favored by law firms and engineering companies. Portals of institutions such as Pickett & Associates, Iberia Airlines, and Burris & Macomber, which provides legal counsel to Mercedes-Benz, were breached through this platform.
Nextcloud and OwnCloud: They are used by organizations that prefer open-source or self-hosted solutions. Organizations such as Brazil's Maida Health and Indonesia's leading satellite operator PT Pacific Satellite Nusantara have been attacked through these platforms.
The list of victims shows an alarming diversity:
Pickett & Associates: 139 GB of data was leaked from a US engineering firm. Infrastructure maps, LiDAR data, and transmission line designs from major energy companies like Duke Energy and Tampa Electric were obtained. This type of data could be used in planning infrastructure sabotage.
Intecro Robotics: One of the critical suppliers to the Turkish defense industry. STEP files, ITAR-controlled models, and CNC programs for the TF-X fighter jet and Akıncı UAV projects have been released for sale in an 11.5 GB package.
Maida Health: It contained the health records of the Brazilian Military Police. The 2.3 TB leak included the identities, family details, and medical reports of the security forces.
Iberia Airlines: 77 GB of data was stolen from Spain's flag carrier airline. This includes A320/A321 maintenance schedules, airworthiness documents, and Airbus ACDATA system dumps.
CRRC MA: The Massachusetts division of the world's largest railroad vehicle manufacturer has had all the engineering records for trains produced for the LA Metro and MBTA compromised. Signal diagrams, SCADA RTU lists, and GPS coordinates of the control rooms have been leaked.
Hudson Rock's research revealed that Zestix also used the alias "Sentap." This threat actor, active between late 2024 and early 2025, operated in closed, Russian-speaking forums.
According to DarkSignal's research, Sentap is associated with an Iranian individual and has been active since at least 2021. The actor employs an approach called the "Trust Exploitation Model," targeting open infrastructure and third-party access.
Zestix/Sentap's operation follows a classic Initial Access Broker (IAB) model. Instead of directly attacking companies, it sells the access it obtains for Bitcoin. Prices can range from a few hundred dollars to tens of thousands of dollars, depending on the value of the victim.
The actor was also found to have ties to the Funksec cybercrime group, known for its high-volume and opportunistic attacks.
Infostealer Ecosystem: The Fuel of Modern Cybercrime
It would be a huge mistake to consider the Zestix campaign an isolated incident. This attack is part of a much larger ecosystem.
The figures for 2025 are alarmingly high:
According to Flashpoint data, identity theft caused by infostealers has increased by 800% since the beginning of the year. More than 1.8 billion corporate and personal accounts have been compromised.
According to Vectra AI's report, 5.8 million devices were infected. In October 2025, 183 million Gmail credentials ended up on dark web marketplaces, sold for as little as $10 per account.
KELA's research reveals an interesting finding: 35.7% of infected devices are personal, unshared computers. Personal devices at home, rather than work computers, are the biggest risk factor. In the era of hybrid work, these devices contain corporate credentials but lack corporate security controls.
According to Verizon's 2025 DBIR report, 88% of web application breaches occur with stolen credentials. Domain information for 54% of ransomware victims was identified in infostealer dumps.
These figures point to one fact: passwords are now the primary entry point for cybercrime.
MFA Bypass: Is It Not Enough on Its Own?
The absence of MFA in the Zestix campaign is a critical factor. However, even with MFA implemented, bypass techniques used by attackers still exist.
Pass-the-Cookie Attacks: Infostealer malware steals not only passwords but also session cookies. When these cookies are injected into the browser, the attacker can impersonate the legitimate user. MFA is already bypassed because the cookie was created after a successful MFA verification.
Data from Recorded Future shows a steady increase in references to terms like "cookies" and "session hijacking" on dark web forums in recent years.
Adversary-in-the-Middle (AiTM) Attacks: Evilginx and Modlishka are examples of such attacks. While the user believes they are accessing a legitimate site, they are actually logging through the attacker's proxy server. Both login credentials and MFA tokens are captured.
MFA Fatigue: The user is constantly harassed by receiving numerous MFA approval notifications. Eventually, the user accidentally or out of frustration approves one. This technique was used in the Uber breach.
These techniques don't render MFA unnecessary, but they show that it's not sufficient on its own.
Lessons Learned and Recommendations
👇🏻
1. MFA Should Be Mandatory, No Exceptions Should Be Allowed.
The common thread among victims of the Zestix campaign is the lack of MFA (Mean Time Failure). Platforms like ShareFile, Nextcloud, and OwnCloud offer strong MFA support, but this feature is not enabled by default.
MFA should be mandatory for all users at all access points. No exceptions should be made for administrators, privileged accounts, or third-party access. Number matching or phishing-resistant MFA (FIDO2/WebAuthn) should be preferred to combat MFA fatigue.
2. Personal Information Hygiene is Critical
One of the report's most striking findings is that some credentials have been sitting in the logs for years. This indicates that passwords were not being changed regularly and sessions were not being invalidated.
A 30-60 day rotation cycle should be established for privileged accounts. A 90-180 day cycle can be applied to regular user accounts. However, current NIST recommendations suggest risk-based rotation instead of mandatory periodic changes. This means that rotation should occur immediately when a security incident is detected or suspicious activity is observed.
Password management tools should be used. Automatic rotation, strong password generation, and usage monitoring can be achieved with these tools.
Integration with services like "Have I Been Pwned" should be implemented. Employee passwords should be checked to see if they have been leaked before.
3. Endpoint Security Needs to Be Redefined
Traditional endpoint protection solutions focus on enterprise devices. However, according to KELA data, most infections occur on personal devices.
Minimum security standards should be established for personal devices accessing corporate resources in a hybrid work model. BYOD policies should be reviewed. Device posture checks should be implemented for access to corporate data.
EDR solutions should focus on infostealer detection. Traditional antivirus solutions can miss these threats. Solutions that perform behavioral analysis should be preferred.
4. Session Management Needs to Be Strengthened
Session durations should be shortened to protect against pass-the-cookie attacks. Sessions longer than 24 hours pose a risk for critical applications.
Conditional access policies should be implemented. Re-authentication may be required when access attempts are made from different IP addresses, different devices, or different locations. Warning mechanisms should be established for abnormal session behavior.
When a malware infection is detected, all active sessions should be immediately terminated. This should be added to incident response playbooks.
5. Threat Intelligence Must Be Proactive
Hudson Rock makes a key point in his report: long before many organizations were listed on Zestix, their credentials could be identified in infostealer logs.
Organizations should monitor domains and email addresses using dark web scanning services. Compromised credential services should be used. Threat intelligence should be positioned as a proactive, not reactive, defense layer.
6. Third-party risks should be assessed.
The CiberC case is particularly noteworthy. This technology integrator, a Cisco Gold Partner, had a breach that had the potential to spread to hundreds of downstream customers.
Supply chain security assessments should be conducted regularly. Third-party security standards should be scrutinized. MFA (Meaningless Failure) should be included in contracts for partners granting access to critical systems.
7. Awareness Training Programs Need to Be Updated
Social engineering techniques like ClickFix persuade users to disable their own security. They use traps such as fake CAPTCHAs and browser error messages.
Employee training should cover these new techniques. Phishing simulations should reflect current attack vectors. A "click if it looks suspicious" message is not enough; users need to know what looks suspicious.
Real-World Example: The Anatomy of an Attack Chain
Instead of theoretical explanations, let's proceed with a concrete scenario. The Iberia Airlines case mentioned in the report is an ideal example to show how the attack chain works.
An Iberia employee accesses a torrent site from their personal computer at home. They download a "free" program. This program contains Lumma infostealer, and during installation, malicious code is silently downloaded.
Lumma starts scanning saved passwords in the browser. In Chrome... iberiaexpress.sharefile.com It finds a registered corporate account. The password, email address, URL, and browser cookies are packaged together.
This "log" ends up on the dark web market within a few hours. Its price is probably a few dollars. Zestix scans these logs with automated tools. The ShareFile URL catches its attention. It realizes it belongs to an enterprise target.
Zestix, with the stolen credentials iberiaexpress.sharefile.com He logs into the address. No MFA (Microsoft Failure). Login successful. He has a treasure trove of 77 GB: A320/A321 maintenance schedules, airworthiness documents, Airbus system logs.
Zestix downloads this data and puts it up for sale on forums. Perhaps another actor will buy it and use it for industrial espionage. Perhaps a rival airline. Perhaps a nation-state actor.
This entire chain could have broken at some point:
•If the employee had received security training and not downloaded software from torrent sites
•If corporate account information was not stored on the personal device
•If MFA were mandatory in the ShareFile portal
•If the corporate password had been changed within 90 days
•If the threat intelligence service had detected that the credentials appeared in the logs
With so many breaking points, none of them were activated.
Sectoral Impact and Regulations
The impact of the Zestix campaign varies across sectors:
Healthcare sector The situation is particularly critical for [company name]. The GreenBills, NMCV Business, and Verahealth breaches could lead to serious sanctions under HIPAA. The average cost of a healthcare data breach is projected to be $7.42 million by 2025. Leaking patient records means both financial and reputational damage.
Defense industry From this perspective, the Interco breach has a national security dimension. The leakage of ITAR-controlled data could have serious legal consequences.
Critical infrastructure In the sector, the Pickett example shows what it means for energy grid maps to fall into the wrong hands. The CRRC MA breach, on the other hand, threatens public transport safety.
Regulations like the NIS2 directive mandate notification and impose significant penalties for such violations. Organizations need to take these threats seriously in terms of compliance.
Result: The attackers entered through the front door.
The most important lesson from the Zestix campaign is this: attackers no longer need sophisticated exploits. A stolen password and a lack of MFA (Miscellaneous Failure) can open the door to the most sensitive data of even the largest organizations.
These attacks weren't caused by a quantum computer breaking encryption. They happened because an employee's device was infected and the organization didn't enforce MFA. It's that simple, that preventable.
According to Hudson Rock data, employee credentials from giant organizations like Deloitte, KPMG, Samsung, Honeywell, Walmart, and even the CDC are currently circulating in infostealer logs. This shows the scale of organizations at risk that are not on the Zestix list.
In the digital age, access is the only valid currency. Protecting that access must be the foundation of security.
Final Words
There's a saying often repeated in the cybersecurity world: "Attackers only need to be right once; defenders always need to be right." The Zestix campaign is a painful reminder of this asymmetry.
However, another lesson from this campaign is encouraging: these attacks were preventable. Basic security hygiene, not complex and expensive security solutions, could have averted these disasters. This includes MFA (Microsoft Facilitation), regular password changes, session management, and awareness training.
Attackers don't need to be sophisticated because targets neglect basic security checks. It's entirely up to organizations to change this equation.
There's no going back for the companies in Zestix's portfolio. But there's still time to avoid sharing the same fate. The fundamental question needs to be asked: Is a password stolen from an employee's infected device years ago still valid today?
You can use Hudson Rock's free tools to check if your organization appears in infostealer logs. Security teams should consider proactive threat intelligence solutions a critical part of their 2026 planning.
First published: LinkedIn, 2026-01-09 13:02. Original article: https://www.linkedin.com/pulse/50-%C5%9Firket-bir-parola-s%C4%B1f%C4%B1r-mfa-melih-%C3%B6zhan-1nahf
Comments