3 ms·
If I am skimming this correctly, this is a C&C client allowing remote control over the network, and uses "a rootkit" for further compromise once it somehow gets
by linsomniac 2y ago
If I am skimming this correctly, this is a C&C client allowing remote control over the network, and uses "a rootkit" for further compromise once it somehow gets installed?
I understand the value of in-depth security reports, but the 5th time they told me "WolfsBane is the Linux counterpart of Gelsevirine, while FireWood is connected to Project Wood." I was wondering when I'd get to the meat and potatoes.
- gerdesj 2y ago"once it somehow gets installed?" The report mentions: "we conclude ... exploited an unknown web application vulnerability ... ." The chain of events, post initial exploit, is all very well but what was the initial point of entry? The IoCs etc are welcome - thanks.
- aorloff 2y agoI thought SQL injection but actually Tomcat ? Might be just an old unpatched server allowing PUTs
- deleted 2y ago[deleted]
- PcChip 2y agoI agree it was very wordy