One Sock Fits All: The use and abuse of the NSOCKS botnet - Lumen Blog
Tags
cmtmf-attack-pattern: Geofencing
maec-delivery-vectors: Watering Hole
attack-pattern: Data Direct Model Models Botnet - T1583.005 Botnet - T1584.005 Credential Stuffing - T1110.004 Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Dns Server - T1583.002 Dns Server - T1584.002 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Geofencing - T1627.001 Geofencing - T1581 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Password Spraying - T1110.003 Phishing - T1660 Phishing - T1566 Server - T1583.004 Server - T1584.004 Ssh - T1021.004 Vulnerabilities - T1588.006 Connection Proxy - T1090 Denial Of Service
Show in Graph
Common Information
Type Value
UUID 53e27757-1873-4e8d-849f-c0389b30a721
Fingerprint b6a1cd298c7074c3
Analysis status DONE
Considered CTI value 1
Text language
Published Nov. 19, 2024, 2 p.m.
Added to db Nov. 19, 2024, 3:01 p.m.
Last updated Nov. 21, 2024, 7:20 a.m.
Headline One Sock Fits All: The use and abuse of the NSOCKS botnet
Title One Sock Fits All: The use and abuse of the NSOCKS botnet - Lumen Blog
Detected Hints/Tags/Attributes 81/3/10
Source URLs
Redirection Url
Details Source https://blog.lumen.com/one-sock-fits-all-the-use-and-abuse-of-the-nsocks-botnet/?utm_source=rss&utm_medium=rss&utm_campaign=one-sock-fits-all-the-use-and-abuse-of-the-nsocks-botnet
URL Provider
Details Provider Source level domain
Details lumen.com blog.lumen.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 39 ✔ Lumen https://blog.lumen.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 2 
remalaxation.name
Details Domain 22 
test.zip
Details Domain 3 
dnslookips.com
Details Domain 4 
ipscoredns.com
Details Domain 4 
nslookups.com
Details File 21 
test.zip
Details md5 2 
9998be16901e7f80aad8d931305e057e
Details IPv4 4 
79.141.162.154
Details IPv4 3 
103.172.92.148
Details IPv4 4 
66.29.128.243