Trusted Design

Striking Oil: A Closer Look at Adversary Infrastructure

概要

While expanding our research into the TwoFace webshell from this past July, we were able to uncover several IP addresses that logged in and directly interfaced with the shell we discovered and wrote about. Investigating deeper into these potential adversary IPs revealed a much larger infrastructure used to execute the attacks. We found the infrastructure was segregated into different functions for specific malicious objectives. We found some sites that were set up as credential harvesters (likely used in phishing attacks), a compromised system that was used to interact with a TwoFace webshell to hide the actor’s location, and finally systems that interact with TwoFace webshell-compromised systems to provide command and control direction of those compromised systems.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Blurring of Commodity and Targeted Attack Malware (score: 0.61)
• Uncovering the Seven Pointed Dagger (score: 0.60)
• Evasive Maneuvers by Wekby with Rop-packing, DNS Covert Channels (score: 0.60)
• OilRig Deploys ALMA Communicator – DNS Tunneling Trojan (score: 0.60)
• Large Malvertising Campaign Goes (Almost) Undetected (score: 0.59)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る