[ByteToBreach]

-

--

BIG BROTHER : https://dump.li/image/d4f4238a61163a41.png
SAMPLES : https://dump.li/image/a837798ae63420f7.png
VEEAM : https://dump.li/image/b995b05fbde4e0f4.png
DEFENSE(LESS) : https://dump.li/image/b2d9ca08f7e56ce0.png
GAME OVER : https://dump.li/image/8c73d425bcd9b7de.png
ORACLE RCE : https://dump.li/image/91eb7988bedaae2e.png
JDWP RCE : https://dump.li/image/6cd75415f5e7ad50.png
OPENFIRE RCE : https://dump.li/image/01734fa70eafb71e.png
RISKS_MATRIX : https://dump.li/image/59873787ca20d47a.png


-- Intro :

This has already been announced and confirmed through 4 communications from Unimed PG :
https://www.unimed.coop.br/site/web/pont...municado-1
https://www.dropbox.com/scl/fo/jfjy69k27...31dw1&dl=0
Although the scale of the attack has been dangerously understated and hidden, and its impact deviously reduced. So i will clarify, with proofs, as usual.

There was the most total compromise imaginable, with 30 Linux servers taken over, most of them being locked with my 'bytetocrypt' (very cringe, i know). The rest of the Windows AD joined host were easily accessible with Administrator account through RDP. A Golden Ticket was setup for persistence, in case Admins passwords start getting rotated (which they did).
Implants > https://www.dropbox.com/scl/fi/pzmq6uveg...3udri&dl=0

Databases dump, local documents, Active Directory dump, local MinIO instances, data lakes, InterSystems db's, Tasy and divers Philips Data. A fully operational hospital could be recreated with the exfiltrated data.
The fully decrypted 5000~ passwords (probably rotated by now) :
Passowords > https://www.dropbox.com/scl/fi/be8xz4ctt...dym9m&dl=0


You can find an interactive map of the network , or at-least, the most important infrastructure (there is a lot of Voip and systems attached that are irrelevant) :
Network map (best viewed with desktop browser) > https://www.dropbox.com/scl/fi/ue6vyqgz0...9z3hi&dl=0

Even if, by a miracle, they manage to get the systems backup up (ESXi and vCenter were both under my control), their Cloudflare and Sucuri accounts are also managed by me. 
Cloudflare > https://www.dropbox.com/scl/fi/by4igctu5...lhqnj&dl=0
Sucuri > https://www.dropbox.com/scl/fi/642oqqv9m...5ztlg&dl=0

I dont know if UNIMED-PG notified LGPD, but here we are.
Celestial Dragons > https://www.dropbox.com/scl/fi/wcq92jxv7...yj8ke&dl=0

-- Vulnerabilities :

* Java Debugging RCE (JDWP).
* OpenFire Auth Bypass.
* React2Shell.
* Password decryption for OpenFire users.
* Java Deserialization.
* ssh pivoting with decrypted password from OpenFire.
* Oracle Scheduler RCE
* Password decryption of TeamPass
* AD Admin from Teampass decrypted passwords
* IPSEC Tunnel for full network acces
* Some other forgotten stuff

- Links :

LINK : https://drive.google.com/drive/folders/1...drive_link
BACKUP 1 : https://www.dropbox.com/scl/fo/n818dl839...yn0id&dl=0
BACKUP 2 : https://ln5.sync.com/dl/d9960f930#6aqvet...9-v5vx5hax

- Contacts:

Signal : @ByteToBreach.33
Session: 05c2db4775cb46350f16814dfe3bfa856664f315585653e4c368af08ce50b0c31b
Telegram: @bytetobreach33
Email : [email protected] / [email protected] (With S)
X: @ByteToBreach
Webiste : Bytetobreach.com

***********************************************
* PS: Prefer messages on Session / Signal.                   **
* Jesus is KING.                                                          **
***********************************************