BreakglassIntelligence
Back to reports
highPhishing

Operation Charger Van — Breakglass Intelligence Report

InvestigatedApril 5, 2026PublishedApril 5, 2026
Threat Actors:ProfileAssessmentTimelinecreates new tunnels frequently)
trycloudflarechargervanratcloudflarewsfwsgidavtorlnk

TLP: WHITE Date: 2026-04-05 Analyst: GHOST (Breakglass Intelligence) Classification: Cybercrime — Initial Access Broker / RAT Deployment Related: Operation Nutten Tunnel, Operation Crest Snake, Operation Klein Changes

Executive Summary

Investigation of the charger-van-feb-circuit Cloudflare Quick Tunnel reveals the fourth documented tunnel rotation by a persistent threat actor targeting German and UK businesses with invoice-themed lures. The tunnel serves a WsgiDAV 4.3.3 open directory containing a complete attack chain: WSH entry point -> JScript WebDAV loader -> batch downloader -> XOR-encrypted Donut shellcode with Early Bird APC injection. This investigation also uncovered a previously undocumented staging tunnel (highland-trend-src-distinct) hosting the full payload archive dating back to November 2025, making this the oldest known artifact from this actor. The actor has 7 confirmed active tunnels as of April 5, 2026. All samples have zero detections on VirusTotal and no prior public reporting.

Critical OPSEC failures identified: the persistence script (pol.bat) references a directory from a previous tunnel (lg07) while the installer creates a different directory (vours), causing the persistence mechanism to silently fail. Additionally, the batch downloader references payload files (tv.bin, t.json) that were never uploaded to the tunnel.

Key Findings

  • 7 LIVE Cloudflare Quick Tunnels confirmed active (charger-van, chubby-resident, highland-trend, klein-changes, crest-ind, wet-envelope, requires-fortune)
  • Same actor confirmed: Identical TTPs (WsgiDAV, oa.wsh/ccv.js chain, PurePythonObfuscator, KISS Loader, Early Bird APC injection)
  • New staging tunnel discovered: highland-trend-src-distinct hosts payload archive dating to November 28, 2025 (Sep01x86_Ayoo.zip)
  • Donut-packed shellcode: 71,938-byte XOR-encrypted payload containing Donut loader with embedded PE (MZ at offset 0x2495)
  • Persistence BROKEN: pol.bat references %LOCALAPPDATA%\lg07 but installer creates %LOCALAPPDATA%\vours — persistence silently fails
  • Missing payloads: neli.bat references tv.bin and t.json which return HTTP 404 — only ov.bin/a.json were deployed
  • German targeting: Lure document is IHK (German Chamber of Commerce) small business invoice template
  • Zero VT detections: Neither so.py nor vwo.zip appear in VirusTotal
  • Tactical evolution: Actor shifting from native DLL (Early Bird via jopfgl.dll/emand.dll) to Python-only chain (KISS Loader)

What Was Found vs. What Was Known

AspectPrior Reporting (3 investigations)Our Findings (this investigation)
Active tunnels5 (requires-fortune, crest-ind, klein-changes, wet-envelope, chubby-resident)7 (+charger-van, +highland-trend)
Oldest artifactJan 14, 2026 (klein-changes WSF)Nov 28, 2025 (Sep01x86_Ayoo.zip on highland-trend)
WsgiDAV versions4.3.0, 4.3.3Confirmed mixed: 4.3.0 (highland-trend, chubby-resident), 4.3.3 (charger-van)
Payload typePython RATs + Early Bird DLLDonut-packed shellcode (new variant) via KISS Loader
EncryptionXOR with PurePythonObfuscator keysSame (32-byte XOR, JSON key files, base64-encoded)
OPSEC failuresSID leak, LNK metadataBroken persistence (wrong directory), missing payloads (tv.bin/t.json), reused scripts across tunnels
Execution variantsPython-only vs DLL+Python4 named variants: Winic (32-bit), DCMv, Callup, sharex (64-bit)

Attack Chain

[1] Victim receives link to tunnel
    |
[2] oa.wsh (WebDAV) -> loads ccv.js from \\charger-van...@SSL\DavWWWRoot\
    |
[3] ccv.js (JScript ActiveXObject) -> copies neli.bat to %TEMP%\r.bat, executes hidden
    |
[4] neli.bat opens IHK invoice PDF lure (ihk.de)
    |-- Downloads pol.bat to Startup (PERSISTENCE - BROKEN: references lg07, not vours)
    |-- Downloads vwo.zip, extracts to %LOCALAPPDATA%\vours
    |-- Downloads Python 3.10.0 embed to same directory
    |
[5] so.py (KISS Loader) decrypts ov.bin using XOR key from a.json
    |
[6] Donut shellcode (71,938 bytes) loaded via Early Bird APC injection into explorer.exe
    |
[7] Donut decrypts embedded PE module and executes in-memory

Alternate Chain (via chubby-resident + highland-trend tunnels)

[1] UKA0X1.txt (downloader) fetches from highland-trend tunnel:
    |-- 1Mar23MA.zip (16.7 MB) -> %USERPROFILE%\Contacts\MainRingtones (Python 3.12 x64 + payloads)
    |-- 1Mar23ST.zip (16.7 MB) -> %USERPROFILE%\Contacts\str
    |-- 1MaDLL.zip (357 KB) -> %APPDATA%\TokenSys (emand.dll - Early Bird DLL)
    |-- 1Mar23SU.txt -> Startup persistence
    |
[2] UKA0X2.txt (executor):
    |-- Runs all .py files in MainRingtones\python312x64\
    |-- Loads emand.dll via regsvr32 /s (DLL variant only)
    |-- Kills Python parent processes via WMI
    |-- Hides extracted folders with attrib +h
    |-- Self-cleanup: deletes all .bat in Contacts, removes staging folders

Infrastructure Analysis

Tunnel Inventory (as of 2026-04-05)

Tunnel NameWsgiDAVRoleStatusFirst SeenInvestigation
charger-van-feb-circuit4.3.3Lure + payload deliveryLIVE2026-03-31This investigation
chubby-resident-airlines-converter4.3.0Batch script hosting (UK chain)LIVE2026-04-01This investigation
highland-trend-src-distinct4.3.0Payload staging (zips, DLLs)LIVE2025-11-28This investigation (NEW)
klein-changes-slim-starter4.3.0WSF dropper hostingLIVE2026-01-14Op. Klein Changes
crest-ind-snake-dublin4.3.0Lure WSH hostingLIVE2026-04-02Op. Crest Snake
wet-envelope-beam-laserUnknownPayload stagingLIVEUnknownOp. Crest Snake
requires-fortune-nutten-eligible4.3.3German lure campaignLIVE2026-03-23Op. Nutten Tunnel

Highland-Trend Tunnel Contents (Payload Archive)

FileSizeDatePurpose
Sep01x86_Ayoo.zip10.6 MB2025-11-28Oldest artifact — x86 payload from Sep/Nov 2025
1MaDLL.zip357 KB2026-03-30Early Bird APC injection DLL (emand.dll/jopfgl.dll)
1Mar23MA.zip16.7 MB2026-04-02Main payload — Python 3.12 x64 + RAT scripts
1Mar23ST.zip16.7 MB2026-04-02Backup/streaming payload
1Mar23SU.bat1.9 KB2025-12-15Old startup persistence (Dec 2025 version)
1Mar23SU.txt2.8 KB2026-03-27Current startup persistence (Mar 2026 version)

Chubby-Resident Tunnel Contents

FileDateDLL Variant?Description
UKA011.txt2026-04-01YESStage 1 downloader — downloads MA + ST + DLL zips
UKA012.txt2026-04-01YESStage 2 executor — runs Python + regsvr32 DLL + cleanup
UKA021.txt2026-04-02NOStage 1 downloader — Python-only (no DLL zip)
UKA022.txt2026-04-02NOStage 2 executor — Python-only (no regsvr32)

Disguise Directory Names

Folder PathDisguised As
%USERPROFILE%\Contacts\MainRingtonesRingtone files
%USERPROFILE%\Contacts\strGeneric
%APPDATA%\TokenSysToken management system
%APPDATA%\WinicWinic software
%USERPROFILE%\Videos\3DAus3D output files
%LOCALAPPDATA%\voursGeneric (charger-van)
%LOCALAPPDATA%\lg07Generic (previous tunnel)

Malware Analysis

Charger-Van Primary Payload

File: vwo.zip -> ov.bin + a.json + so.py

PropertyValue
vwo.zip SHA256ab1ac7b16251a98bf0ca4a8df0c78de21b395ddd0a81aa273dd0fd40a3af7f03
so.py SHA2565cab6bf65f7836371d5c27fbfc20fe10c0c4a11784990ed1a3d2585fa5431ba6
ov.bin SHA25697b7c807c35e06f2fbc4723844b4dc99188de3c0e920d7b77fffce5f3d9a88db
a.json SHA256ff5a9c8bad4d0afa5fba68a08cf91dbda0619c06a143dcd0aeb5c2c5dccd0274
Decrypted shellcode SHA25643caced9aa891ec593e4d3f09e9858c5d63ba4f23584e86b6673146e75181045
EncryptionXOR with 32-byte key from PurePythonObfuscator
XOR Key (hex)d38b4e224197e1758b2d7e9453e332db112bbfd1be51ef01f28d874ed2b90a48
Shellcode size71,938 bytes
PackerDonut loader (call +0xBB88, pop rcx, structure-based API resolution)
Injection techniqueEarly Bird APC (T1055.004)
Target processexplorer.exe (default)
Embedded PEMZ header at offset 0x2495 within Donut instance (encrypted)
VT Detections0/0 (not submitted)

Encryption Details

Key generator: PurePythonObfuscator v1.0
Entropy source: secrets+urandom+time+pid
Random seed: jNlLbmwnGkqiY2+XkmvHeQ==
XOR key (base64): 04tOIkGX4XWLLX6UU+My2xErv9G+Ue8B8o2HTtK5Ckg=
Integrity SHA256: a3437b0605513413d6803f832d416a691a92ed970b3f5a76b93693b33465bbcf

so.py (KISS Loader) Analysis

The loader is labeled "KISS Loader - Early Bird APC Injection for Lab Testing" and implements:

  1. XOR decryption using key from JSON file
  2. Early Bird APC injection via:
    • CreateProcessW (suspended, no window)
    • VirtualAllocEx (RWX)
    • WriteProcessMemory
    • QueueUserAPC
    • ResumeThread
  3. Basic shellcode validation (checks first bytes for Meterpreter/x64/x86 patterns)
  4. System info collection (OS, arch, username, computername)

Donut Shellcode Structure

Offset 0x0000: e8 88 bb 00 00          call +0xBB88 (jump to code)
Offset 0x0005: [48008 bytes]           Donut instance (encrypted PE module)
  - 0x0000: Instance length (0xBB88)
  - 0x0004: CHASKEY key (32 bytes)
  - 0x0024: IV/nonce (8 bytes)
  - 0x2495: Encrypted PE (MZ header visible after Donut decryption)
Offset 0xBB8D: [23925 bytes]           Donut loader code
  - pop rcx (get instance pointer)
  - API hash resolution
  - VirtualAlloc (MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)
  - Instance decryption
  - PE loading and execution

Dropper Chain Files

FileSHA256Purpose
oa.wsh94fe098ad878291c43bd3515da6dca27ead39377f524152d357bb004e0cdb723WebDAV script host launcher
ccv.jsccb47e0a1f0e55a35ba1d554070d3524a45dfa5b86ca36cd5fb7d05dbdd144caJScript WebDAV copier + executor
neli.batc37ccf440732aa346ea7541b80a3799bff4437e052023bacde50cef1c89801c2Main batch downloader (opens lure, downloads payloads)
pol.batf84763ec289fc0389b0dd1b240bbaa8a231b54ad0decc1b66b0eb07e5c7a70e2Startup persistence (BROKEN - wrong directory)
desktop.ini8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68Windows folder descriptor (UTF-16)

Highland-Trend DLL Payload

PropertyValue
1MaDLL.zip SHA256314c2cb202e4cea8d63051325abe326dfb75ae2995e843f6e8eea247290f59a1
Contentsemand.dll (Early Bird APC injection DLL)
Loadingregsvr32 /s (silent COM registration)
Previously documentedjopfgl.dll in Op. Klein Changes (GCC 15.1.0 compiled)

Threat Actor Profile

Attribution Assessment

  • Confidence: HIGH (cross-investigation consistency)
  • SID: S-1-5-21-3343087317-1842942590-547433828-500 (Administrator, confirmed across all campaigns)
  • Country/Region: Likely German-speaking or targeting German speakers
  • Motivation: Financial (Initial Access Broker / RAT deployment)
  • Sophistication: MODERATE (custom tooling, multi-tunnel architecture, but frequent OPSEC failures)

OPSEC Failures (This Investigation)

  1. Broken persistence: pol.bat references %LOCALAPPDATA%\lg07 (from previous tunnel), but neli.bat creates %LOCALAPPDATA%\vours. Persistence will silently fail on reboot.
  2. Missing payloads: neli.bat attempts to decrypt tv.bin with t.json, but neither file exists on the tunnel (HTTP 404). Only ov.bin/a.json were deployed.
  3. Reused scripts: pol.bat is a direct copy from a previous tunnel without updating the directory path.
  4. Left old artifacts online: highland-trend tunnel still hosts Sep01x86_Ayoo.zip from November 2025 and 1Mar23SU.bat from December 2025.
  5. All tunnels remain active: Despite being investigated 3 times, all 7 tunnels are still live and accessible.
  6. Anonymous read-write access: All WsgiDAV instances allow unauthenticated read-write access.

Actor Timeline

DateEventTunnelEvidence
2025-11-28Sep01x86_Ayoo.zip uploadedhighland-trendFile timestamp
2025-12-151Mar23SU.bat (old startup) createdhighland-trendFile timestamp
2026-01-14First WSF dropperklein-changesInvestigation
2026-03-23German lure campaignrequires-fortuneInvestigation
2026-03-27Startup persistence updated (.txt variant)highland-trendFile timestamp
2026-03-301MaDLL.zip (Early Bird DLL) uploadedhighland-trendFile timestamp
2026-03-31desktop.ini placedcharger-vanFile timestamp
2026-04-01UKA011/012 (DLL variant) deployedchubby-residentFile timestamp
2026-04-02UKA021/022 (Python-only variant) deployedchubby-residentFile timestamp
2026-04-02Main payload zips updatedhighland-trendFile timestamp
2026-04-02Lure hosting activecrest-indInvestigation
2026-04-03ccv.js, neli.bat, oa.wsh uploadedcharger-vanFile timestamp
2026-04-05ALL 7 tunnels confirmed LIVEAllThis investigation

Tactical Evolution

The actor demonstrates clear evolution across the investigation timeline:

  1. Sep-Nov 2025: x86-only payloads (Sep01x86_Ayoo.zip)
  2. Dec 2025: Added 32-bit/64-bit dual architecture (1Mar23SU.bat)
  3. Jan-Mar 2026: WSF dropper chain, multiple RAT variants
  4. Late Mar 2026: Added native DLL injection (1MaDLL.zip/emand.dll via regsvr32)
  5. Apr 1, 2026: DLL + Python dual-payload chain (UKA011/012)
  6. Apr 2, 2026: Removed DLL, Python-only chain (UKA021/022) — possible detection avoidance
  7. Apr 3, 2026: New tunnel (charger-van) with Donut-packed shellcode via KISS Loader — significant capability upgrade

The shift from Python RAT scripts to Donut-packed shellcode with Early Bird APC injection represents a notable escalation in sophistication.

MITRE ATT&CK Mapping

TacticTechniqueIDApplication
Initial AccessPhishing: Spearphishing LinkT1566.002Link to WsgiDAV tunnel
ExecutionUser Execution: Malicious FileT1204.002oa.wsh -> ccv.js chain
ExecutionCommand and Scripting: JScriptT1059.007ccv.js ActiveXObject
ExecutionCommand and Scripting: Windows Command ShellT1059.003neli.bat, pol.bat
ExecutionCommand and Scripting: PythonT1059.006so.py KISS Loader, RAT scripts
ExecutionSystem Services: Service ExecutionT1569.002regsvr32 /s emand.dll
PersistenceBoot or Logon Autostart: Startup FolderT1547.001pol.bat in Startup folder
Defense EvasionProcess Injection: Early Bird APCT1055.004QueueUserAPC into explorer.exe
Defense EvasionObfuscated Files: Encrypted/Encoded FileT1027.013XOR-encrypted .bin payloads
Defense EvasionDeobfuscate/Decode FilesT1140XOR decryption at runtime
Defense EvasionMasquerading: Match Legitimate NameT1036.005Folders named MainRingtones, TokenSys, Winic
Defense EvasionHide Artifacts: Hidden FilesT1564.001attrib +h on payload directories
Defense EvasionSigned Binary Proxy Execution: Regsvr32T1218.010regsvr32 /s for DLL loading
Lateral MovementRemote Services: SMB/WebDAVT1021.002WebDAV file access via UNC paths

IOC Summary

Network Indicators

  • charger-van-feb-circuit[.]trycloudflare[.]com — WsgiDAV 4.3.3 — Lure + payload delivery — LIVE
  • chubby-resident-airlines-converter[.]trycloudflare[.]com — WsgiDAV 4.3.0 — Batch hosting — LIVE
  • highland-trend-src-distinct[.]trycloudflare[.]com — WsgiDAV 4.3.0 — Payload staging — LIVE
  • klein-changes-slim-starter[.]trycloudflare[.]com — WSF dropper hosting — LIVE
  • crest-ind-snake-dublin[.]trycloudflare[.]com — Lure WSH hosting — LIVE
  • wet-envelope-beam-laser[.]trycloudflare[.]com — Payload staging — LIVE
  • requires-fortune-nutten-eligible[.]trycloudflare[.]com — German lure campaign — LIVE
  • hxxps://www[.]ihk[.]de/blueprint/servlet/resource/blob/5581278/1cafa7f203df9d83e050d9f01677ffe6/rechnung-kleinunternehmer-data[.]pdf — Lure document (legitimate IHK invoice template)

File Indicators

SHA256FilenameType
ab1ac7b16251a98bf0ca4a8df0c78de21b395ddd0a81aa273dd0fd40a3af7f03vwo.zipPayload archive
5cab6bf65f7836371d5c27fbfc20fe10c0c4a11784990ed1a3d2585fa5431ba6so.pyKISS Loader (Early Bird APC)
97b7c807c35e06f2fbc4723844b4dc99188de3c0e920d7b77fffce5f3d9a88dbov.binXOR-encrypted Donut shellcode
ff5a9c8bad4d0afa5fba68a08cf91dbda0619c06a143dcd0aeb5c2c5dccd0274a.jsonPurePythonObfuscator XOR key
43caced9aa891ec593e4d3f09e9858c5d63ba4f23584e86b6673146e75181045ov_decrypted.binDecrypted Donut shellcode
ccb47e0a1f0e55a35ba1d554070d3524a45dfa5b86ca36cd5fb7d05dbdd144caccv.jsJScript WebDAV copier
c37ccf440732aa346ea7541b80a3799bff4437e052023bacde50cef1c89801c2neli.batMain downloader batch
94fe098ad878291c43bd3515da6dca27ead39377f524152d357bb004e0cdb723oa.wshWSH entry point
f84763ec289fc0389b0dd1b240bbaa8a231b54ad0decc1b66b0eb07e5c7a70e2pol.batPersistence (broken)
314c2cb202e4cea8d63051325abe326dfb75ae2995e843f6e8eea247290f59a11MaDLL.zipEarly Bird DLL archive

Behavioral Indicators

  • Startup persistence: Random-named .bat in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
  • Working directories: %LOCALAPPDATA%\vours, %LOCALAPPDATA%\lg07, %USERPROFILE%\Contacts\MainRingtones, %APPDATA%\TokenSys, %APPDATA%\Winic
  • Python embed download: hxxps://www[.]python[.]org/ftp/python/3.10.0/python-3.10.0-embed-amd64.zip
  • Hidden folders: attrib +h applied to payload directories
  • VBS helpers: rhn.vbs, rhnE.vbs, DiscordDial.vbs, py_parent.vbs in %USERPROFILE%\Contacts\
  • Process pattern: python.exe spawned as parent of explorer.exe (killed via WMI after payload execution)

Immediate (24-48 hours)

  • Block all 7 tunnel domains at DNS/proxy level
  • Search for so.py, ov.bin, a.json file names in %LOCALAPPDATA% and %USERPROFILE%\Contacts
  • Check Startup folder for random-named .bat files containing so.py or python references
  • Look for python.exe running from non-standard paths (Contacts, Videos, AppData)

Short-term (1-2 weeks)

  • Submit IOCs to MalwareBazaar, ThreatFox, URLhaus
  • Report tunnels to Cloudflare abuse (abuse@cloudflare.com) — all 7 tunnels
  • Hunt for additional tunnel rotations (actor creates new tunnels frequently)
  • Deploy YARA rules for KISS Loader and PurePythonObfuscator key files

Medium-term (1-3 months)

  • Monitor trycloudflare.com CT logs for new WsgiDAV instances
  • Track PurePythonObfuscator tooling for new variants
  • Cross-reference Donut shellcode hashes with sandbox submissions

References

GHOST — Breakglass Intelligence "One indicator. Total infrastructure."

Share