Operation Talked: Russia-Nexus APT vs a Homelab Pentest Pipeline — Same Tools, Different Discipline

SOCRadar just published a detailed teardown of Operation Talked, a 14-month Russia-linked espionage campaign (attributed to UAC-0056/UAC-0114) that breached 9 Ukrainian defense and aerospace contractors, stealing full Git repository dumps. The campaign was still active at publication (July 29, 2026), with an interactive shell open on a Ukrainian railway logistics operator.

What caught my attention: their C2 stack is almost identical to what I run in my automated pentest pipeline.

The Toolset Comparison

These are literally the same open-source tools. The offensive ecosystem has completely democratized the toolset — a state-sponsored actor and a homelab run the same stack.

Where They Win: Post-Exploitation Windows AD

Their real advantage is in the post-exploitation phase, specifically Active Directory:

• mimikatz — LSASS memory dump (T1003.001)
• DonPAPI — DPAPI credential harvest (T1555.003)
• NetExec — Pass-the-Hash via nxc smb -H (T1550.002)
• Kerberos ticket theft — Pass-the-Ticket (T1550.003)
• evil-winrm — WinRM lateral movement (T1021.006)
• git-dumper — bulk Git repository exfiltration (T1213)
• proxychains-ng across 80+ proxies — multi-hop exfil (T1090.003)

My pipeline is Linux/web focused. No AD lateral movement module. This is the genuine gap.

Where I Win: OPSEC and Automation

OPSEC

This is where the comparison becomes almost comical.

They ran everything on a bare Yandex Cloud IP (AS13238, Moscow) with zero reverse proxy. One service was a raw python3 -m http.server listener on port 8090 — serving 8,436 operational files with no authentication. Tools, stolen credentials, target lists, Sliver session logs, WireGuard private keys — all publicly accessible.

That single misconfiguration gave SOCRadar a 14-month case file built entirely from the attacker’s own perspective.

My setup:

• Traefik reverse proxy in front of every service
• Fly.io redirectors — C2 traffic never hits the real server IP
• Docker secrets for all credentials
• Prometheus alerts on unexpected inbound connections

I would have detected an unauthorized reader on my infrastructure within minutes. They didn’t notice for weeks.

The attribution tells the same story: their bash history contained commands mistyped with their Russian JCUKEN keyboard layout (cd typed as св, ls as ды). A VPN cannot mask muscle memory.

Automation

They worked manually, hands-on-keyboard. My pipeline runs continuously without intervention:

15 scanning replicas, automated exploit queues, AI-powered triage. They had an operator manually enumerating databases on a compromised server. I have a queue processor.

Full MITRE ATT&CK Coverage

Their complete TTP map across the 14-month campaign:

My pipeline covers T1595 through T1573. Everything from T1003 onward is the gap.

Key CVEs in Their Arsenal

• CVE-2022-1040 — Sophos XG RCE (757,000 targets scanned)
• CVE-2024-55591 — FortiOS auth bypass
• CVE-2025-31324 — SAP NetWeaver deserialization RCE
• CVE-2023-46747 — F5 BIG-IP unauth RCE
• CVE-2026-63030 — WordPress wp2shell (very recent)
• CVE-2025-49113 / CVE-2025-25257 — Roundcube RCE

All 6 have Nuclei templates in my pipeline’s template library.

The Takeaway

State-sponsored actors with significant resources are running the same open-source offensive toolstack as a homelab. The sophistication gap isn’t in the tools — it’s in operational discipline and automation.

They had better post-exploitation depth (Windows AD). I have better OPSEC and full automation. They got caught because of a SimpleHTTP server left running on their C2.

The democratization of offensive tooling is real. What differentiates operators isn’t access to exotic tools — it’s how they run them.

Source: SOCRadar — Operation Talked, July 29 2026
MITRE ATT&CK Navigator layer available in the bojemoi CTI repo