4 ms·
The strangest part here is that the malware sample they obtained does nothing but periodically wipe the server disks. That seems like it would be relatively low
by MauranKilom 5y ago
The strangest part here is that the malware sample they obtained does nothing but periodically wipe the server disks. That seems like it would be relatively low impact (people have backups, right?) and a surefire way to get found out.
What gives?
- Lammy 5y agoMaybe it's somebody's way to forcibly clue people in to the possibility of this type of vulnerability, like https://en.wikipedia.org/wiki/Metcalf_sniper_attack https://en.wikipedia.org/wiki/Metcalf_sniper_attack
- codetrotter 5y agoThe Wikipedia article you linked does not mention the motivation for the attack, but your comment seems to say that the motivation was to make others aware of this type of vulnerability. If you have any other links which talk about that, please include one of them.
- dannyw 5y agoI suspect this isn't the original implant, but rather a 'clean up' one. The APT probably had already obtained all the intelligence they want; now their goal is to make the server appear to misbehave, so it gets taken out and recycled for e-waste.
- dogma1138 5y agoYep, Amn is Iran’s Kaspersky (Padvish AV) this was most likely a TLA level actor operation. The overall analysis is a bit on the shallow side there might be more things there that they didn’t uncover. The odd thing is that the malware creates a file name basically called “fake firmware” that seems a bit too amateurish for the usual suspects… Might be KSA’s NSA for hire level op.