Git Directory Exposure Leaks 9,000 Observer Profiles

Securing Critical Educational and Professional Infrastructures

A critical process-level vulnerability combined with exposed version control directories has led to a massive identity and operational compromise affecting professional exam infrastructure. The incident highlights how minor configuration errors on peripheral subdomains can escalate into systemic breaches that jeopardize the integrity of national examination processes, public trust, and extensive lists of sensitive personnel records. Rather than targeting core database structures directly from the outside, the threat actor exploited exposed administrative configurations to gain access to critical source files, laying bare the physical and digital workflows of the target organization.

For organizations operating across the GCC region, where digital transformation has rapidly transitioned legacy administrative structures online, this incident serves as an essential warning. Left unmonitored, exposed assets on public subdomains act as direct gateways for advanced persistent threats and independent threat actors. Organizations must continuously assess their external exposure using robust Attack Surface Management solutions to identify exposed directories and misconfigurations before they are targeted.

Understanding the Physical and Digital Compromise

The core of the incident involved the compromise of an observer application website hosting the entire coordinate infrastructure for professional examination bodies. This portal managed the logistics of center coordinators and examiners, tracking their identification documents and administrative credentials. By compromising this single portal, the adversary obtained a highly compressed archive containing more than 9,000 application PDFs of observers slated for upcoming 2026 examination sessions.

The implications of this dataset leakage are severe. The compromised files contained highly sensitive Personally Identifiable Information (PII) and corporate secrets, including full names, mobile phone numbers, personal photographs, physical signatures, residential addresses, dates of birth, tax identification numbers (specifically PAN cards), bank account numbers, branch locations, and international routing codes (such as IFSC codes). With such granular details exposed, the threat actor, operating under the alias zowico, possessed enough data to orchestrate highly targeted spear-phishing campaigns, financial fraud, and business email compromise schemes against the affected observers.

To understand if your own organization has suffered similar exposures, assessing public exposure must be an immediate priority. If the domain already looks exposed, use Dark Web Scanner before requesting a full report.

Deep Technical Analysis of the Attack Chain

The attack vector utilised by the threat actor showcases a classic lateral movement and privilege escalation methodology that began with simple reconnaissance. The adversary identified an exposed version control repository on a public-facing subdomain. This type of misconfiguration is catalogued as CWE-538 (File and Directory Information Exposure) and represents a severe vulnerability in deployment pipelines.

Step 1: Reconnaissance and Exposed Directory Discovery

The threat actor conducted active external scanning against target subdomains, identifying an open and accessible /.git/ directory on the live Board of Studies portal. When development teams push code directly to production web roots without stripping version control metadata, they expose the internal architecture of their applications. The attacker leveraged this exposure to download critical Git tracking objects, configurations, and reference indices.

Step 2: Offline Code Reconstruction

Using public open-source tools, the attacker reconstructed the complete repository structure and application source code offline. Analyzing the code allowed the attacker to find hardcoded configuration files, internal database connection strings, application programming interface (API) keys, and administrative access paths. This step demonstrates why local code reviews and secure software deployment lifecycles are critical to modern enterprise security.

Step 3: Lateral Movement and Superadmin Escalation

Equipped with administrative credentials harvested from the source code, the threat actor bypassed standard external defenses to target database and administrative control panels across different directories. They successfully established Remote Code Execution (RCE) on the examiner portals and took over the observer-centric subdomain. Web shells were likely injected during this phase to maintain persistent command and control access over the server environments.

Step 4: Manipulation of Physical-to-Digital Workflows

In addition to raw data theft, the adversary identified a major architectural weakness in the physical examination security process. The delivery of physical examination papers relied on standard courier logistics, secure bank vault handoffs, and an observer validation key requiring verification codes, user selfies, and GPS location coordinates via a mobile observer application.

The threat actor demonstrated that the digital safeguards designed to protect this workflow were entirely inadequate. The GPS verification check relied on standard, client-supplied GPS coordinates that are easily spoofed on rooted or jailbroken mobile devices using basic development software. Furthermore, the master verification keys used to confirm coordinates were stored insecurely or were readily accessible via administrative endpoints on the compromised observer website. This physical-to-digital validation failure highlights the danger of relying on client-side data for core security constraints.