3 ms·
Most of the time the exfil doesn’t go to Russian IP space or anything like that. It goes to an S3 bucket controlled by the attacker, and looks exactly like back
by tatersolid 4y ago
Most of the time the exfil doesn’t go to Russian IP space or anything like that. It goes to an S3 bucket controlled by the attacker, and looks exactly like backup or replication traffic.
Network-layer security devices are pretty useless in 2023. Everything is encrypted and everything talks to everything else as part of “normal” operations.