Trusted Design

Exploring a P2P Transient Botnet - From Discovery to Enumeration

概要

We recently deployed a high interaction honeypots expecting it to be compromised by a specific malware. But in the first few days, instead of getting infected by the expected malware, it received a variety of attacks ranging from SSH port forwarding to "Viagra and Cialis" SPAM to XORDDoS failed deployment attempts. By the third day, it was insistently hit and compromised by Rakos, a Linux/Trojan.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

New Trojan for Linux infects routers (score: 0.62)
A New All-in-One Botnet: Proteus (score: 0.62)
SSH Bruteforce / Linux XOR Malware / DDoS UPDATED: 14/04/2016 (score: 0.62)
Honeypot intruder downloading a perl IRC bot (score: 0.61)
Uncovering Bunitu’s Secrets (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

APT41

Score: 8.89

Matched TTPs:

T1069 - Permission Groups Discovery
T1082 - System Information Discovery
T1190 - Exploit Public-Facing Application
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Scattered Spider

Score: 7.93

Matched TTPs:

T1069 - Permission Groups Discovery
T1082 - System Information Discovery
T1114.003 - Email Forwarding Rule

MITREへのリンク →

TA505

Score: 5.26

Matched TTPs:

T1069 - Permission Groups Discovery
T1608.001 - Upload Malware

MITREへのリンク →

Volt Typhoon

Score: 18.27

Matched TTPs:

T1069 - Permission Groups Discovery
T1190 - Exploit Public-Facing Application
T1584.005 - Botnet
T1614 - System Location Discovery
T1584.004 - Server
T1090.001 - Internal Proxy

MITREへのリンク →

APT3

Score: 4.49

Matched TTPs:

T1069 - Permission Groups Discovery
T1082 - System Information Discovery

MITREへのリンク →

FIN13

Score: 8.89

Matched TTPs:

T1069 - Permission Groups Discovery
T1082 - System Information Discovery
T1190 - Exploit Public-Facing Application
T1090.001 - Internal Proxy

MITREへのリンク →

HAFNIUM

Score: 8.94

Matched TTPs:

T1583.005 - Botnet
T1190 - Exploit Public-Facing Application
T1584.005 - Botnet

MITREへのリンク →

APT5

Score: 5.31

Matched TTPs:

T1583.005 - Botnet
T1190 - Exploit Public-Facing Application

MITREへのリンク →

Ke3chang

Score: 6.52

Matched TTPs:

T1583.005 - Botnet
T1082 - System Information Discovery
T1190 - Exploit Public-Facing Application

MITREへのリンク →

BlackByte

Score: 4.65

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1190 - Exploit Public-Facing Application

MITREへのリンク →

OilRig

Score: 3.18

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware

MITREへのリンク →

ZIRCONIUM

Score: 3.60

Matched TTPs:

T1082 - System Information Discovery
T1102.002 - Bidirectional Communication

MITREへのリンク →

HEXANE

Score: 5.58

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1102.002 - Bidirectional Communication

MITREへのリンク →

TA2541

Score: 3.18

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware

MITREへのリンク →

Gamaredon Group

Score: 5.58

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1102.002 - Bidirectional Communication

MITREへのリンク →

APT37

Score: 3.60

Matched TTPs:

T1082 - System Information Discovery
T1102.002 - Bidirectional Communication

MITREへのリンク →

APT32

Score: 3.18

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware

MITREへのリンク →

Lazarus Group

Score: 13.50

Matched TTPs:

T1082 - System Information Discovery
T1102.002 - Bidirectional Communication
T1584.004 - Server
T1027.007 - Dynamic API Resolution
T1090.001 - Internal Proxy

MITREへのリンク →

Higaisa

Score: 4.13

Matched TTPs:

T1082 - System Information Discovery
T1090.001 - Internal Proxy

MITREへのリンク →

Mustang Panda

Score: 7.31

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1027.007 - Dynamic API Resolution

MITREへのリンク →

FIN7

Score: 9.98

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1190 - Exploit Public-Facing Application
T1195.002 - Compromise Software Supply Chain
T1102.002 - Bidirectional Communication

MITREへのリンク →

Kimsuky

Score: 10.49

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1190 - Exploit Public-Facing Application
T1114.003 - Email Forwarding Rule
T1102.002 - Bidirectional Communication

MITREへのリンク →

MuddyWater

Score: 5.07

Matched TTPs:

T1082 - System Information Discovery
T1190 - Exploit Public-Facing Application
T1102.002 - Bidirectional Communication

MITREへのリンク →

TeamTNT

Score: 7.72

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1610 - Deploy Container

MITREへのリンク →

Magic Hound

Score: 5.07

Matched TTPs:

T1082 - System Information Discovery
T1190 - Exploit Public-Facing Application
T1102.002 - Bidirectional Communication

MITREへのリンク →

Daggerfly

Score: 6.97

Matched TTPs:

T1082 - System Information Discovery
T1195.002 - Compromise Software Supply Chain
T1584.004 - Server

MITREへのリンク →

Contagious Interview

Score: 3.18

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware

MITREへのリンク →

APT42

Score: 3.18

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware

MITREへのリンク →

SideCopy

Score: 7.31

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1614 - System Location Discovery

MITREへのリンク →

Mustard Tempest

Score: 3.18

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware

MITREへのリンク →

Turla

Score: 9.37

Matched TTPs:

T1082 - System Information Discovery
T1102.002 - Bidirectional Communication
T1584.004 - Server
T1090.001 - Internal Proxy

MITREへのリンク →

Moonstone Sleet

Score: 6.11

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Sandworm Team

Score: 20.97

Matched TTPs:

T1082 - System Information Discovery
T1608.001 - Upload Malware
T1190 - Exploit Public-Facing Application
T1584.005 - Botnet
T1195.002 - Compromise Software Supply Chain
T1102.002 - Bidirectional Communication
T1499 - Endpoint Denial of Service
T1584.004 - Server

MITREへのリンク →

Earth Lusca

Score: 6.28

Matched TTPs:

T1608.001 - Upload Malware
T1190 - Exploit Public-Facing Application
T1584.004 - Server

MITREへのリンク →

Star Blizzard

Score: 5.41

Matched TTPs:

T1608.001 - Upload Malware
T1114.003 - Email Forwarding Rule

MITREへのリンク →

Threat Group-3390

Score: 6.37

Matched TTPs:

T1608.001 - Upload Malware
T1190 - Exploit Public-Facing Application
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

APT28

Score: 8.41

Matched TTPs:

T1190 - Exploit Public-Facing Application
T1102.002 - Bidirectional Communication
T1498 - Network Denial of Service

MITREへのリンク →

GOLD SOUTHFIELD

Score: 4.40

Matched TTPs:

T1190 - Exploit Public-Facing Application
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Leviathan

Score: 4.30

Matched TTPs:

T1190 - Exploit Public-Facing Application
T1584.004 - Server

MITREへのリンク →

Dragonfly

Score: 7.23

Matched TTPs:

T1190 - Exploit Public-Facing Application
T1195.002 - Compromise Software Supply Chain
T1584.004 - Server

MITREへのリンク →

Axiom

Score: 5.09

Matched TTPs:

T1190 - Exploit Public-Facing Application
T1584.005 - Botnet

MITREへのリンク →

APT39

Score: 6.80

Matched TTPs:

T1190 - Exploit Public-Facing Application
T1102.002 - Bidirectional Communication
T1090.001 - Internal Proxy

MITREへのリンク →

Silent Librarian

Score: 3.44

Matched TTPs:

T1114.003 - Email Forwarding Rule

MITREへのリンク →

LAPSUS$

Score: 3.44

Matched TTPs:

T1114.003 - Email Forwarding Rule

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 7.06

Matched TTPs:

T1564.005 - Hidden File System
T1090.001 - Internal Proxy

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Sandworm Team

Score: 0.82

Matched TTPs:

T1082 - System Information Discovery
T1190 - Exploit Public-Facing Application
T1195.002 - Compromise Software Supply Chain
T1584.004 - Server
T1608.001 - Upload Malware
T1584.005 - Botnet
T1499 - Endpoint Denial of Service
T1102.002 - Bidirectional Communication

MITREへのリンク →

Volt Typhoon

Score: 0.70

Matched TTPs:

T1069 - Permission Groups Discovery
T1190 - Exploit Public-Facing Application
T1584.004 - Server
T1614 - System Location Discovery
T1090.001 - Internal Proxy
T1584.005 - Botnet

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る