Exposed Server Reveals DoNot APT Toolkit Targeting Pakistan Nuclear and Energy Sectors
Do Son 
Relationship between recovered scripts and the Pakistani nuclear, power, industrial-control, and oil-and-gas references identified in their contents
TL;DR
Security researchers discovered an unsecured server hosting a suspected DoNot APT toolkit designed to spy on critical infrastructure. The exposed scripts specifically hunt for files tied to nuclear facilities, power grids, and industrial control systems. Furthermore, this DoNot APT toolkit targeting Pakistan uses network spoofing to steal local credentials and move across internal workstations.
What Happened on the Exposed Staging Server
In October 2026, a researcher known as Demon at Hunt.io uncovered an open directory hosted at 193.29.104.84 on port 8099. According to the technical investigation on InfraHunter, the French M247 server held 48 files totaling roughly 12 MB. The attackers uploaded an initial batch of 34 files on October 9 and updated the arsenal through October 14.
“The scripts contain hardcoded references to Pakistan’s nuclear infrastructure, power sector, and industrial control systems (ICS), including PAEC, Chashma, KANUPP, SCADA, and Modbus,” the report stated. Once the attackers breached a workstation running an account named ELECTRICAL, they ran batch scripts to check PowerShell versions and folder permissions. Next, a script named go.bat used a bundled curl binary to download additional payloads into the %USERPROFILE%\Wallet\Hunrd\ directory.
Reverse Shells and Inveigh Credential Harvesting
To keep access to the victim machine, the DoNot APT toolkit ran multiple reverse shells in continuous two-second loops. These tools included PowerShell scripts alongside three compiled Go executables (rvb80_232.exe, rvb61135.exe, and rvb_new.exe) that connected to 179.43.145.232 and 193.29.104.84. Over five days, the operators refined their Go binaries by stripping symbols and adding TLS encryption. Additionally, the folder held a custom HTTP implant named Beacon-trydnd1.exe and a Metasploit x64 loader called rv88b.exe.
Meanwhile, the operators deployed Inveigh, a PowerShell utility that poisons LLMNR, NBNS, and mDNS traffic to capture NetNTLM password hashes. Across 10 script versions, the attackers improved their stealth by launching Inveigh inside a hidden background process. On October 14, updated scripts (invgo2.bat) modified local environment variables to impersonate the Oil and Gas Development Company Limited (OGDCL). “The October 14 addition of OGDCL domain spoofing shows the actor refining this step to be more convincing,” the researcher noted.
Who Is Behind the Activity
Investigators linked the exposed DoNot APT toolkit targeting Pakistan to APT-C-35 with medium-to-high confidence by combining data from multiple independent sources. Specifically, a connectivity check script (tcptest.ps1) pinged a backup command-and-control server at 31.7.61.8 on port 443. According to VirusTotal passive DNS records, that IP address resolved to the domain pakdw.orchidheaven.online.
In July 2026, StrikeReady Labs flagged that exact domain in an India-linked espionage campaign using a malicious PowerPoint file named File Copy.ppt. That presentation used Auto_Open macros to drop batch scripts and scheduled tasks inside the %PUBLIC%\Music\ directory. Furthermore, an earlier report by QianXin (Heavy Shadows) identified the C:\Users\Public\Music\aco path as a signature staging folder for DoNot APT, while Rewterz and Cyble previously documented the group’s focus on Pakistani defense targets.
Impact and Reconnaissance Scale
Inside the compromised environment, the attackers focused heavily on data collection and lateral expansion. Specifically, scripts named hunt88.bat and contenthunt.bat scanned the ELECTRICAL user’s documents, browser history, and recent files for 15 keywords. These terms included the Pakistan Atomic Energy Commission (PAEC), Chashma, KANUPP, NTDC, WAPDA substations, and SCADA telemetry.
In addition, the operators uploaded a file named ad_pwd.txt on October 10 containing a plaintext credential. Using a script called lantest.bat, the intruders tested three sets of hardcoded credentials against administrative C$ shares across 30 local IP addresses on the 192.168.6.0/24 subnet.
How Organizations Can Stay Protected
Critical infrastructure defenders can disrupt the DoNot APT toolkit by hardening internal network protocols and monitoring endpoint activity. First, network administrators should disable legacy name resolution protocols like LLMNR and NetBIOS Name Service (NBNS) to stop Inveigh from capturing NetNTLM hashes. Second, security teams should block outbound connections to 193.29.104.84, 179.43.145.232, 31.7.61.8, and pakdw.orchidheaven.online. Finally, defenders must monitor workstations for unauthorized files in %USERPROFILE%\Wallet\Hunrd\ or %PUBLIC%\Music\ and restrict administrative share access across local subnets.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
