Trusted Design

First Exploit Attempts For Juniper Backdoor Against Honeypot

概要

SANS Institute detected numerous login attempts against their SSH honeypots using the ScreenOS backdoor password. Their honeypot doesn't emulate ScreenOS beyond the login banner, so they do not know what the attackers are up to, but some of the attacks appear to be "manual" in that they do see the attacker trying different commands. SANS reported seeing the first attempt at 17:43:43 UTC about an hour after they adjusted the kippo honeypot to return the Netscreen banner.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Juniper Screenos Backdoor Password Seen Used in the Wild (score: 0.70)
• #kippo bruteforce ssh logs 09/05/2015 (score: 0.68)
• Kippo Honeypot Attacker IPs 09/11/2015-09/13/2015 (score: 0.65)
• Kippo Honeypot Attacker IPs, 09/10/2015 (score: 0.62)
• Confirmed Malicious Kippo SSH Bruteforce UPDATE 08-05-2016 (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る