Threat Actors Breach Global Companies Using Leaked Cloud Credentials

A sophisticated cybercriminal operating under the moniker “Zestix” (alias “Sentap”) has successfully infiltrated approximately 50 major global enterprises through a deceptively devastating yet straightforward attack vector: stolen cloud credentials harvested from infostealer malware infections.

The campaign, which has compromised organizations across aviation, defense, healthcare, legal, and infrastructure sectors, represents a catastrophic failure in basic security hygiene rather than sophisticated zero-day exploitation.

According to an exhaustive investigation conducted by Hudson Rock for Infostealers.com, the threat actor has been auctioning massive datasets exfiltrated from ShareFile, OwnCloud, and Nextcloud instances belonging to critical entities including Iberia Airlines, Sekisui House, CRRC MA, Intecro Robotics, and numerous law firms and healthcare providers.

The combined data totals exceed 3 terabytes of sensitive corporate information, including defense blueprints and patient health records.

The Zestix campaign exposes a fundamental weakness in modern enterprise security: the absence of Multi-Factor Authentication (MFA) on critical cloud file-sharing portals.

Unlike sophisticated attacks involving session hijacking or cookie theft, these breaches occurred through straightforward credential abuse enabled by widespread infostealer infections.

The attack flow follows a predictable pattern: employees inadvertently download malicious files containing infostealer malware such as RedLine, Lumma, or Vidar.

These infostealers execute silently, harvesting all saved credentials, browser histories, and authentication tokens from infected devices.

The stolen data is then aggregated into massive databases accessible on dark web marketplaces, where actors like Zestix systematically parse logs searching for corporate cloud portal credentials.

A critical finding reveals the latency of this threat. While some credentials were harvested from recently infected machines, others had been dormant in criminal databases for years.

Organizations failed to implement basic credential hygiene practices such as mandatory password rotation or session invalidation, transforming years-old infections into present-day catastrophes.

Sentap has demonstrated clear affiliations with the Funksec cybercriminal group, aligning with their modus operandi of high-volume, opportunistic attacks.

When organizations neglect to enforce MFA, attackers walk through the front door using valid username-password combinations no exploits required.

High-Value Targets Across Critical Sectors

The victim portfolio spans diverse industries with devastating consequences for each. Pickett & Associates, a prominent U.S. engineering firm serving major utilities including Tampa Electric and Duke Energy Florida, suffered a 139.1 GB breach exposing over 800 classified LiDAR files, operational blueprints, and high-resolution orthophotos of transmission line corridors and substations.

This data could enable infrastructure analysis for potential sabotage planning against critical U.S. utilities.

In the defense sector, Turkey’s Intecro Robotics a top manufacturer supplying TUSAŞ (TF-X fighter jet) and Baykar Makina (Akıncı/TB3 UAVs) lost 11.5 GB of ITAR-controlled data including complete 3D models, 5-axis CNC programs for titanium components, and manufacturing drawings with high-precision tolerances.

The breach provides sufficient detail for unauthorized 1:1 manufacture of safety-critical aerospace components.

Iberia Airlines’ compromise exposed 77 GB of technical safety data including AMP maintenance programs for A320/A321 aircraft, Airworthiness Limitation Sections, and confidential Air Operator Certificate details.

CRRC MA, the Massachusetts subsidiary of the world’s largest rolling stock manufacturer, lost 100% of its engineering servers containing complete signaling drawings, SCADA RTU lists, and deliberately withheld test reports for LA Metro and MBTA transit systems, including precise GPS coordinates of control rooms.

Healthcare organizations suffered massive HIPAA violations. Maida Health’s breach exposed 2.3 TB of Brazilian Military Police health records including identification cards, medical reports, and family details.

GreenBills lost 39.52 GB containing over 111,000 patient files with complete intake forms, treatment descriptions, and signed assignment of benefits for workers’ compensation claims.

Iranian Origins and Cybercriminal Networks

Recent intelligence analysis by DarkSignal has attributed the “Sentap” persona to an Iranian national active since at least 2021.

 One of the largest datasets in the portfolio, this breach covers the health records of the Brazilian Military Police.

The actor employs an opportunistic “Trust Abuse Model,” targeting exposed infrastructure and third-party access points while demonstrating clear affiliations with the Funksec cybercriminal group.

Operating comfortably within Russian-language closed forums, Zestix functions as an Initial Access Broker (IAB), selling compromised access for Bitcoin with a reputation for reliability established throughout 2024-2025.

The tragedy of the Zestix campaign lies not in sophisticated exploitation but in preventable negligence. Traditional cybersecurity tools firewalls, EDR, and SIEM systems effectively defend corporate perimeters but remain blind to the “Third Space” of personal employee devices where infostealers operate undetected.

Hudson Rock’s Cavalier intelligence platform addresses this gap by tracking global infostealer distribution and indexing exfiltrated logs before weaponization.

According to Hudson Rock researchers, compromised credentials often sit in criminal databases for years before exploitation a critical window for remediation that these organizations failed to utilize.

The solution requires mandatory MFA enforcement on all external-facing portals and proactive monitoring of employee credentials appearing in compromised databases.

The Zestix campaign serves as an urgent wake-up call: in the modern threat landscape, access remains the only currency that matters, and basic security controls represent the difference between protection and catastrophic breach.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.