BreakglassIntelligence
Back to reports

4.8 Million Accounts, 18 Workers, Every Root Password Exposed: Inside a Live Twitter/X Credential Stuffing Botnet

PublishedApril 10, 2026
credential-stuffingtwitterbotnetturkeyunauthenticatedc2-infrastructure

Published: April 10, 2026 Classification: TLP:CLEAR GHOST Investigation ID: GHOST-2026-0410-TWITTERSTUFFER

Executive Summary

An unauthenticated command-and-control panel at 144[.]76[.]57[.]92:5000 operates a credential stuffing botnet targeting Twitter/X accounts at scale. The panel — titled "Twitter Checker Master Panel - FULL FIX v2.3" — requires zero authentication to access, exposing the full operational infrastructure: 18 worker servers with root SSH credentials in plaintext, real-time attack statistics, combo list management, and result exfiltration.

During a 12-minute observation window on April 10, 2026, GHOST captured the operation testing 722,763 credentials and compromising 18 additional Twitter/X accounts in real time. Total lifetime statistics show 4.8 million+ accounts tested with 138 confirmed compromises — accounts that lacked two-factor authentication.

The operator is Turkish-speaking. All 18 worker servers sit within a single /24 block owned by Komuta Savunma Yuksek Teknoloji Limited Sirketi ("Command Defense High Technology LLC") in Ankara, Turkey. Every worker credential follows the same pattern: a 12-character hex prefix followed by kmt.!, — a likely abbreviation of the hosting provider's name.

At time of publication, this infrastructure has zero detections on VirusTotal (0/94), no coverage on ThreatFox, URLhaus, or AbuseIPDB.

Table of Contents

  1. Discovery and Access
  2. C2 Infrastructure
  3. Unauthenticated API Surface
  4. Live Statistics: Watching the Operation Run
  5. Worker Infrastructure
  6. Password Pattern Analysis
  7. Deployment Timeline
  8. Turkish Language Attribution
  9. Komuta Savunma Hosting Provider
  10. Historical Infrastructure
  11. The 2FA Signal
  12. MITRE ATT&CK Mapping
  13. Indicators of Compromise
  14. Detection Status
  15. What This Report Adds to the Public Record
  16. Recommendations
  17. Evidence Manifest

Discovery and Access

GHOST identified an exposed Flask application on 144[.]76[.]57[.]92:5000 during routine infrastructure scanning. The application presented a full-featured credential stuffing management panel with no authentication gate — no login form, no API keys, no session tokens. Every endpoint, every function, every credential stored in the panel is accessible to anyone who connects.

This is not a misconfiguration of an otherwise-secured panel. The application was built without authentication. There is no login route in the source. There is no middleware checking credentials. The entire operational security model assumes obscurity — that nobody will find port 5000 on this IP.

That assumption failed.

C2 Infrastructure

AttributeValue
IP Address144[.]76[.]57[.]92
Port5000 (HTTP)
HostingHetzner Online GmbH, Falkenstein, Saxony, Germany
ASNAS24940
OSWindows Server 2019
HostnameWIN-FPU47O3PTJV
StackPython Flask + Socket.IO + Chart.js
Panel TitleTwitter Checker Master Panel - FULL FIX v2.3
Additional ServicesRDP (3389), SMB (445), WinRM (5985)
TLS CertificateLet's Encrypt for impact[.]gradientconnectedai[.]com (expired 2025-06-09)

The C2 runs on a Windows Server 2019 instance at Hetzner's Falkenstein data center. Beyond the Flask panel on port 5000, the server exposes RDP, SMB, and WinRM — a Windows administration surface wide open to the internet. The auto-generated hostname WIN-FPU47O3PTJV suggests a default installation with no hardening.

The panel itself is a single-page application built on Flask with Socket.IO for real-time log streaming and Chart.js for graphing check rates over time. The full panel source (98KB) was captured.

Unauthenticated API Surface

Every operational function is exposed via REST endpoints with no authentication:

EndpointMethodFunction
/api/serversGETLists ALL servers with SSH credentials in plaintext
/api/stats/totalGETReturns live aggregate statistics
/api/bulk/startPOSTStart credential checking on selected servers
/api/bulk/stopPOSTStop credential checking on selected servers
/api/bulk/restartPOSTRestart the checker process
/api/bulk/uploadPOSTUpload combo files (credential lists) to servers
/api/bulk/downloadPOSTDownload results (compromised accounts) from servers
/api/bulk/settingsPOSTPush configuration (worker count, sleep intervals, proxy lists)
/api/bulk/reset-txtPOSTReset result files on workers

The panel also uses WebSocket events for real-time monitoring:

  • subscribe_logs — Subscribe to live log feed from a specific worker
  • log_update — Real-time statistics pushed to connected clients
  • ping — 30-second heartbeat to maintain connection

The /api/servers endpoint is the most damaging exposure. A single GET request returns every worker server's IP address, root SSH password, installation status, health metrics, and operational state. This is the equivalent of leaving a spreadsheet of all your infrastructure credentials on a public web server — because that is literally what this is.

The /api/bulk/upload and /api/bulk/download endpoints mean anyone with network access can inject their own credential lists into the operation or exfiltrate the compromised account results. The /api/bulk/start and /api/bulk/stop endpoints mean anyone can control the botnet.

Live Statistics: Watching the Operation Run

GHOST captured statistics at four points over a 12-minute window on April 10, 2026:

Time (UTC)CheckedHits (Compromised)2FA ProtectedErrorsCPM
20:304,139,8171203,564,638394,8934,482
20:354,418,8761263,795,052431,5034,500
20:384,699,5101334,027,723467,3224,516
20:424,862,5801384,163,790487,1284,523

Key Observations

Throughput: 722,763 accounts checked in 12 minutes — approximately 60,230 checks per minute across all workers, though the panel's own CPM counter averaged ~4,500 (likely measuring a single metric differently). Extrapolating the observed rate yields an estimated 6.5 million checks per day.

Compromise rate: 18 new hits in 12 minutes. The overall hit rate is 0.0028% (138 out of 4,862,580) — low, but credential stuffing is a volume game. At this scale, even fractions of a percent produce actionable results.

2FA wall: 85.6% of all checked accounts (4,163,790 of 4,862,580) returned a 2FA challenge. The operation is designed to filter these out — it cannot bypass 2FA. It hunts exclusively for the 14.1% of accounts that rely on password-only authentication.

Error rate: 10.0% of checks result in errors (rate limiting, network failures, invalid credential format). This is a mature operation — the error rate is stable across all four snapshots, suggesting the operator has tuned proxy rotation and request timing.

Worker Infrastructure

All 18 active workers are in the 31[.]58[.]245[.]0/24 range, owned by Komuta Savunma Yuksek Teknoloji Limited Sirketi in Ankara, Turkey. All use root SSH access on port 22.

Server NameIP AddressRoot PasswordDate Added
Sunucu 831[.]58[.]245[.]86ec4f10cee3cckmt.!,2025-12-25
Sunucu 931[.]58[.]245[.]105c10b0ae83de8kmt.!,2025-12-25
Sunucu 1031[.]58[.]245[.]123db6bedcc4e67kmt.!,2025-12-25
Sunucu 1131[.]58[.]245[.]134812adbff6415kmt.!,2025-12-25
Sunucu 1231[.]58[.]245[.]13586bbddec65a7kmt.!,2025-12-25
Sunucu 1331[.]58[.]245[.]1032f6a7d8b4759kmt.!,2026-01-20
Sunucu 1431[.]58[.]245[.]9649844a1b097akmt.!,2026-01-20
Sunucu 1531[.]58[.]245[.]899a35e3d82625kmt.!,2026-01-20
Sunucu 1631[.]58[.]245[.]74a6385bea14b1kmt.!,2026-01-20
Sunucu 1731[.]58[.]245[.]72f4d3f543a9eakmt.!,2026-01-20
Sunucu 1831[.]58[.]245[.]1934072f35cc53akmt.!,2026-01-31
Sunucu 1931[.]58[.]245[.]1771804397bf62ckmt.!,2026-01-31
Sunucu 2031[.]58[.]245[.]17609fc08578b83kmt.!,2026-01-31
Sunucu 2131[.]58[.]245[.]165ed38c48d251akmt.!,2026-01-31
Sunucu 2231[.]58[.]245[.]16091263615d387kmt.!,2026-01-31
Sunucu 2331[.]58[.]245[.]1562c44a8a4bcfdkmt.!,2026-01-31
Sunucu 2431[.]58[.]245[.]148bec4dd66904fkmt.!,2026-01-31
Sunucu 2531[.]58[.]245[.]1476128f8bf2202kmt.!,2026-01-31

Server names use the Turkish word "Sunucu" (server). Numbering begins at 8 — servers 1 through 7 previously existed and have been removed from the panel, indicating either decommissioned infrastructure or an earlier generation of workers that were rotated out.

Password Pattern Analysis

Every root password follows an identical structure:

[12-character lowercase hex string]kmt.!,

Examples:

  • ec4f10cee3cc + kmt.!,
  • c10b0ae83de8 + kmt.!,
  • db6bedcc4e67 + kmt.!,

The 12-character hex prefix appears randomly generated (likely derived from a hash or UUID truncation). The kmt suffix almost certainly references Komuta — the hosting provider where all workers reside. The .!, suffix is a static complexity suffix to satisfy password policy requirements.

This pattern tells us several things:

  1. Single operator or small team — all passwords use the same generation scheme, suggesting one person provisioning all servers.
  2. Provider relationship — the kmt tag indicates familiarity with Komuta Savunma, possibly a reseller relationship or bulk provisioning arrangement.
  3. Programmatic generation — the hex prefixes are consistent with automated provisioning, not manual password selection.

Deployment Timeline

The worker deployment occurred in three distinct waves, followed by software installation:

Wave 1 — December 25, 2025 (Christmas Day)

Servers: Sunucu 8-12 (5 servers) IPs: 31[.]58[.]245[.]86, .105, .123, .134, .135

The initial deployment happened on Christmas Day. Someone was standing up credential stuffing infrastructure while most of the security industry was offline. This is a common pattern — threat actors frequently time infrastructure deployment to holidays and weekends when monitoring and response capabilities are reduced.

Wave 2 — January 20, 2026

Servers: Sunucu 13-17 (5 servers) IPs: 31[.]58[.]245[.]103, .96, .89, .74, .72

A second batch of equal size, added 26 days after the initial deployment. This suggests the operation validated its approach with the first wave and scaled horizontally.

Wave 3 — January 31, 2026

Servers: Sunucu 18-25 (8 servers) IPs: 31[.]58[.]245[.]193, .177, .176, .165, .160, .156, .148, .147

The largest deployment — 8 servers in a single day, 11 days after Wave 2. The operation was scaling aggressively.

Mass Installation — February 24, 2026

All 18 servers had the checker software installed on the same day, indicating a coordinated deployment of the checking tooling across the full fleet.

Latest Activity — March 18, 2026

Sunucu 25 (31[.]58[.]245[.]147) had its checker reinstalled, suggesting troubleshooting or an update to the checking software.

Turkish Language Attribution

The panel UI is entirely in Turkish with no localization options. Key strings observed:

TurkishEnglishContext
Sunucu EkleAdd ServerWorker management
Toplu BaslatBulk StartMass operation control
Toplu DurdurBulk StopMass operation control
CaliskanRunningServer status
DurdurulmusStoppedServer status
DosyalarFilesCombo/result management
AyarlarSettingsConfiguration
KurInstallSoftware deployment
SaglikHealthServer monitoring
Canli IstatistiklerLive StatisticsReal-time dashboard

The server names ("Sunucu 8" through "Sunucu 25"), the hosting provider relationship (Komuta Savunma, Ankara), the kmt password pattern, and the entirely Turkish UI collectively point to a Turkish-speaking operator based in or closely connected to Turkey.

Komuta Savunma Hosting Provider

AttributeValue
Full NameKomuta Savunma Yuksek Teknoloji Limited Sirketi
English TranslationCommand Defense High Technology Limited Company
RIPE OrganizationORG-KSYT1-RIPE
IP Range31[.]58[.]245[.]0/24
AddressYesilova Mh. 4023 Cd. Ser Tower No:1 Ic Kapi No:147, 06796 Etimesgut, Ankara, Turkey
Upstream ProviderDataPenta (abuse@datapenta[.]com)
Domainkomutacloud[.]com (resolves to 31[.]58[.]245[.]10)
RIPE Registration2024-12-03

Komuta Savunma is a relatively new entity — its RIPE registration dates to December 2024, barely a year before this botnet was deployed on their infrastructure. Shodan indexes 1,148 services across the /24 block.

The provider is not exclusively malicious. The same /24 hosts what appear to be legitimate Turkish businesses — bakeries, software companies, booking platforms. This is consistent with a small hosting provider serving a mix of legitimate and abusive customers, rather than a bulletproof hosting operation.

The abuse path runs through DataPenta, the upstream provider.

Historical Infrastructure

The C2 server carries a Let's Encrypt TLS certificate issued for impact[.]gradientconnectedai[.]com, expired since June 9, 2025. This domain was registered through Namecheap.

The expired certificate suggests the C2 server was repurposed — it previously hosted something under the GradientConnectedAI domain, and the operator either acquired the server secondhand or pivoted from a different project. The certificate was never renewed, indicating the operator either doesn't need TLS for the credential stuffing panel (it runs over plain HTTP on port 5000) or lacks the domain control to renew it.

The 2FA Signal

The most striking number in this dataset is 85.9% — the proportion of tested Twitter/X accounts that returned a two-factor authentication challenge.

Out of 4,862,580 accounts tested:

  • 4,163,790 (85.6%) were protected by 2FA
  • 487,128 (10.0%) returned errors
  • 211,662 (4.4%) had valid credentials but no 2FA
  • 138 (0.003% of non-2FA accounts) were successfully compromised

This operation is, inadvertently, the largest independent validation of Twitter/X's 2FA adoption rate we have seen. The credential stuffing pipeline treats 2FA as a hard stop — there is no bypass attempt, no session hijacking, no SIM swap integration. When an account has 2FA enabled, the checker moves on.

The 138 compromised accounts represent users who:

  1. Reused credentials from a breached database
  2. Did not enable any form of two-factor authentication

Both are preventable. This is credential stuffing at its most basic — no zero-days, no exploits, no sophistication. Just volume and the statistical certainty that some fraction of users will have weak hygiene.

MITRE ATT&CK Mapping

IDTechniqueApplication
T1078Valid AccountsCredential stuffing to obtain valid Twitter/X credentials
T1110.004Credential StuffingCore operation — 4.8M+ credentials tested against Twitter/X
T1583.003Acquire Infrastructure: VPSHetzner C2 server + 18 Komuta Savunma worker servers
T1571Non-Standard PortC2 panel served on port 5000
T1102Web ServiceTwitter/X API abuse for credential validation
T1059Command and Scripting InterpreterSSH-based remote command execution on workers
T1021.004Remote Services: SSHAll worker management via root SSH

Indicators of Compromise

C2 Server

144[.]76[.]57[.]92    (Hetzner Online GmbH, AS24940, Falkenstein, Germany)

Worker Servers (Komuta Savunma, AS?, Ankara, Turkey)

31[.]58[.]245[.]86
31[.]58[.]245[.]105
31[.]58[.]245[.]123
31[.]58[.]245[.]134
31[.]58[.]245[.]135
31[.]58[.]245[.]103
31[.]58[.]245[.]96
31[.]58[.]245[.]89
31[.]58[.]245[.]74
31[.]58[.]245[.]72
31[.]58[.]245[.]193
31[.]58[.]245[.]177
31[.]58[.]245[.]176
31[.]58[.]245[.]165
31[.]58[.]245[.]160
31[.]58[.]245[.]156
31[.]58[.]245[.]148
31[.]58[.]245[.]147

Domains

impact[.]gradientconnectedai[.]com    (historical, cert expired 2025-06-09)
komutacloud[.]com                      (hosting provider, resolves to 31[.]58[.]245[.]10)

Network Signatures

  • C2 panel: HTTP on port 5000, Flask/Socket.IO
  • Workers: SSH on port 22 (root access)
  • C2 additional services: RDP (3389), SMB (445), WinRM (5985)

Detection Status

PlatformC2 IP (144[.]76[.]57[.]92)Worker IPs (31[.]58[.]245[.]0/24)
VirusTotal0/940/94
ThreatFoxNo coverageNo coverage
URLhausNo coverageNo coverage
AbuseIPDBNo reportsNo reports

At time of publication, this infrastructure is completely undetected across all major threat intelligence platforms.

What This Report Adds to the Public Record

  • Full documentation of a live, active credential stuffing operation targeting Twitter/X at scale
  • Complete worker infrastructure map with 18 server IPs, root credentials, and deployment timeline
  • Real-time statistical capture demonstrating the operation's throughput and compromise rate
  • Attribution indicators pointing to a Turkish-speaking operator using Turkish hosting infrastructure
  • Empirical data on Twitter/X 2FA adoption rates derived from 4.8M+ credential tests
  • Unauthenticated API surface documentation showing the full operational capability of the panel
  • Password pattern analysis linking the operator to the Komuta Savunma hosting provider

Recommendations

For Twitter/X:

  • The 19 IP addresses listed above should be blocked at the platform level immediately
  • Rate limiting on authentication endpoints should be reviewed — 4,500+ checks per minute sustained over months suggests gaps
  • The 138 compromised accounts should be force-reset

For Hetzner Online GmbH:

  • 144[.]76[.]57[.]92 is operating a credential stuffing C2 with exposed RDP, SMB, and WinRM
  • Abuse report warranted

For DataPenta / Komuta Savunma:

  • 18 servers in 31[.]58[.]245[.]0/24 are being used as credential stuffing workers
  • Root SSH credentials for all 18 are publicly exposed via the unauthenticated C2 panel

For all Twitter/X users:

  • Enable two-factor authentication. This operation proves it works — 85.9% of accounts were protected by 2FA, and the botnet cannot bypass it
  • Do not reuse passwords across services. The 138 compromised accounts were found through credential lists sourced from previous breaches

Evidence Manifest

FileDescriptionSize
panel-full.htmlComplete panel source code98 KB
api-servers.jsonWorker list with credentials (first capture)—
api-servers-final.jsonWorker list with credentials (second capture)—
api-stats.jsonLive statistics (first capture, 20:30 UTC)—
api-stats-final.jsonLive statistics (final capture, 20:42 UTC)—

All evidence preserved in GHOST investigation archives.

This report documents a live operation. Infrastructure may change or go offline following publication.

GHOST — Breakglass Intelligence https://intel.breakglass.tech

Share