4 ms·
I suspect this isn't the original implant, but rather a 'clean up' one. The APT probably had already obtained all the intelligence they want; now their goal is
by dannyw 5y ago
I suspect this isn't the original implant, but rather a 'clean up' one. The APT probably had already obtained all the intelligence they want; now their goal is to make the server appear to misbehave, so it gets taken out and recycled for e-waste.
- dogma1138 5y agoYep, Amn is Iran’s Kaspersky (Padvish AV) this was most likely a TLA level actor operation. The overall analysis is a bit on the shallow side there might be more things there that they didn’t uncover. The odd thing is that the malware creates a file name basically called “fake firmware” that seems a bit too amateurish for the usual suspects… Might be KSA’s NSA for hire level op.