otx.alienvault.com Open in urlscan Pro
99.86.4.57  Public Scan

Form analysis
0 forms found in the DOM

Text Content

×

   
 * Browse
 * Scan Endpoints
 * Create Pulse
 * Submit Sample
 * API Integration
   
   
 * Login | Sign Up
   

All
   
 * Login | Sign Up
   
 * 
   


Share
Actions
Subscribers (176289)
Suggest Edit
Clone
Embed
Download
Report Spam



VULNERABILITY ATTACK THREATS ON THE CLOUD

   
 * Created 2 days ago by AlienVault
 * Public
 * TLP: White

In the first month of 2022, the Apache Log4j2 vulnerability outbreak that began
in December has also come to an end, and the number of related attack sources
has decreased significantly. However, the number of cloud server attack source
IPs of old vulnerabilities, such as Docker Remote API unauthorized access
vulnerability and Fortinet FortiOS unauthorized arbitrary file reading
vulnerability, suddenly increased significantly compared with December.

Reference:
https://blog.netlab.360.com/public-cloud-threat-intelligence-202201/
Tags:
anglerfish, honeypot, botnet, log4shell, docker
Att&ck IDs:
T1552.007 - Container API , T1613 - Container and Resource Discovery , T1584.005
- Botnet , T1068 - Exploitation for Privilege Escalation , T1203 - Exploitation
for Client Execution , T1584.004 - Server , T1190 - Exploit Public-Facing
Application , T1526 - Cloud Service Discovery , T1530 - Data from Cloud Storage
Object

Endpoint Security
Scan your endpoints for IOCs from this Pulse!
Learn more
 * Indicators of Compromise (37)
 * Related Pulses (37)
 * Comments (0)
 * History (0)

URL (10)Hostname (1)FileHash-MD5 (10)CVE (2)FileHash-SHA1 (7)FileHash-SHA256 (7)

TYPES OF INDICATORS

Show
10 25 50 100
entries
Search:

type

indicator

Role

title

Added

Active

related Pulses

hostnameoracle.zzhreceive.topFeb 21, 2022, 3:38:44 PM22

URLhttp://58.226.35.74/tmateELF 64-bit LSB executable, x86-64, version 1 (SYSV),
statically linked, strippedFeb 21, 2022, 3:38:44 PM0

URLhttp://58.226.35.74/midd.jpgFeb 21, 2022, 3:38:44 PM0

URLhttp://194.38.20.242/kinsingFeb 21, 2022, 3:38:44 PM1

URLhttp://194.38.20.242/d.shFeb 21, 2022, 3:38:44 PM0

URLhttp://194.145.227.21/ldr.shASCII textFeb 21, 2022, 3:38:44 PM6

FileHash-SHA256f9a872a323bc787f19e70afd0148c9fa160375c462b30622b98e9e70c8da832aUnix.Trojan.Prochider-9821784-0Feb
21, 2022, 3:38:44 PM0

FileHash-SHA256eca42c42f0909cf4e6df6bf8de35ab93ef6a3dd10d0d5e556721ec1871a9990cFeb
21, 2022, 3:38:44 PM11

FileHash-SHA256cbb37344fdf2429306d4f608237def14465f5667080f6ee43c732d8d42fa7e5bUnix.Downloader.Rocke-6826000-0Feb
21, 2022, 3:38:44 PM1

FileHash-SHA25688904f0f36a1c66f36c510f2ae4a99ee73358b62ac8d18dd845fd29a9b3b1fcaUnix.Trojan.Prochider-9821784-0Feb
21, 2022, 3:38:44 PM0


SHOWING 1 TO 10 OF 37 ENTRIES
1
2
3
4
Next


COMMENTS

You must be logged in to leave a comment.

Refresh Comments

 * © Copyright 2022 AlienVault, Inc.
   
 * Legal
   
 * Status