IoT devices and Linux-based systems targeted by OpenSSH trojan campaign | Microsoft Security Blog
Tags
cmtmf-attack-pattern: Masquerading
country: United Kingdom
attack-pattern: Data /Etc/Passwd And /Etc/Shadow - T1003.008 Botnet - T1583.005 Botnet - T1584.005 Credentials - T1589.001 Cron - T1053.003 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Firmware - T1592.003 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Server - T1583.004 Server - T1584.004 Social Media - T1593.001 Ssh - T1021.004 Systemd Service - T1543.002 Systemd Service - T1501 Tool - T1588.002 Vulnerabilities - T1588.006 Brute Force - T1110 Masquerading - T1036 Rootkit - T1014 Denial Of Service Masquerading Rootkit
Show in Graph
Common Information
Type Value
UUID 1136c9b2-b762-4494-8b0d-efa9fc012bbc
Fingerprint 35fd2810075eaec1
Analysis status DONE
Considered CTI value 0
Text language
Published June 22, 2023, 9 a.m.
Added to db June 23, 2023, 8:59 a.m.
Last updated Nov. 17, 2024, 5:57 p.m.
Headline IoT devices and Linux-based systems targeted by OpenSSH trojan campaign
Title IoT devices and Linux-based systems targeted by OpenSSH trojan campaign | Microsoft Security Blog
Detected Hints/Tags/Attributes 80/3/17
Source URLs
Redirection Url
Details Source https://www.microsoft.com/en-us/security/blog/2023/06/22/iot-devices-and-linux-based-systems-targeted-by-openssh-trojan-campaign/
URL Provider
Details Provider Source level domain
Details microsoft.com www.microsoft.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 337 ✔ Microsoft Security Blog https://www.microsoft.com/en-us/security/blog/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 2 
inst.sh
Details Domain 2 
vars.sh
Details Domain 396 
protonmail.com
Details Domain 1 
rsh.sys-stat.download
Details Domain 287 
yahoo.com
Details Domain 1 
cardingforum.cx
Details Domain 1 
madagent.tm
Details Domain 1 
madagent.cc
Details Domain 207 
learn.microsoft.com
Details Domain 107 
aka.ms
Details Domain 1373 
twitter.com
Details Email 1 
dotsysadmin@protonmail.com
Details Email 1 
ancientgh0st@yahoo.com
Details File 1 
rsh.sys
Details Url 7 
https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy.
Details Url 22 
https://aka.ms/threatintelblog.
Details Url 15 
https://twitter.com/msftsecintel.