# The Devil, Eight Million Emails, and a Whole Lot of Milk

Internet-exposed RDWeb/RD Gateway terminal server with no MFA was breached via a single weak domain credential, then abused to send 8.9M Boots-phishing emails direct-to-MX.

- Payout: Real-world hack
- Severity: critical
- Program: Huntress partner client
- Credited: Huntress
- Disclosed: 2026-06-15
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/terminal-server-phishing-stager-exposed
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-terminal-server-phishing-stager-exposed
- Tags: domain:infra impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:windows technique:legacy-endpoint technique:recon vuln:auth-bypass vuln:mfa-bypass vuln:misconfiguration

**Target:** Internet-facing Windows RD Session Host with IIS RDWeb Access and RD Gateway
**Root cause:** Single published domain account with a weak password, no MFA, exposed RDWeb portal; attacker authenticated and staged a legitimate bulk mailer (Gammadyne) on the desktop.
**Steps:**
1. Enumerate exposed RDWeb portal on port 443 (`/RDWeb/Pages/en-US/login.aspx`)
2. Brute-force the single published domain account; success returns HTTP 302 vs 200 on failure
3. Authenticate as `[DOMAIN]\[user]`, pull published `.rdp` file, connect through RD Gateway
4. Stage `gm.exe` (Gammadyne Mailer), `dracii.mmp` project, and six `milk (N).txt` recipient lists in `C:\Users\[user]\Desktop\dam pe uk puterniiicccc\`
5. Configure direct-to-MX delivery, 666 threads, no DKIM; send Boots-branded survey lure linking to `hxxps://ipelc.gob[.]bo/boots_store/`
6. Reconnect to disconnected session 16 later to run the campaign
**How found:** Huntress agent deployed mid-incident raised a critical 4624 logon with a previously-seen malicious RDP client hostname DESKTOP-[REDACTED] from Romanian IP 212.93.152[.]37; analysts pivoted to IIS logs (four 302s among 206k POSTs), then reconstructed the session via TS logs (Event 25 = reconnect to session 16) and parsed the Gammadyne project file for campaign config.
**Exploitation:** Attacker used stolen/brute-forced domain credential to log into RDWeb, opened an RDP session via RD Gateway, staged a commercial bulk mailer and 8.9M-address lists, then sent Boots-impersonating survey phishing from the victim's clean outbound IP direct to recipient MX servers on TCP/25, harvesting PII/card data via a cloned storefront on a compromised Bolivian government site.
**Escalation:** Reused the same credential across multiple source IPs and days; hosted payload on a trusted .gob.bo domain to bypass reputation/domain-age filters; direct-to-MX so blocklisting lands on the victim's IP, not the operator's.
**Insight:** On RDWeb portals, a 302 vs 200 on login.aspx is the success signal — grep IIS logs for it to find the real credential-validating source among hundreds of thousands of brute-force POSTs, and use TS-LocalSessionManager Event 25 to distinguish reconnects to pre-existing sessions from fresh logons when Security auditing is sparse.