EMERALDWHALE: 15k Cloud Credentials Stolen in Operation Targeting Exposed Git Config Files
Tags
cmtmf-attack-pattern: Active Scanning
country: France
maec-delivery-vectors: Watering Hole
attack-pattern: Data Active Scanning - T1595 Cloud Services - T1021.007 Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Email Addresses - T1589.002 Ip Addresses - T1590.005 Javascript - T1059.007 Phishing - T1660 Phishing - T1566 Python - T1059.006 Search Engines - T1593.002 Server - T1583.004 Server - T1584.004 Sms Messages - T1636.004 Software - T1592.002 Web Services - T1583.006 Web Services - T1584.006 Tool - T1588.002 Vulnerabilities - T1588.006 Vulnerability Scanning - T1595.002 Connection Proxy - T1090
Show in Graph
Common Information
Type Value
UUID d6b0c925-36f0-49f5-9009-3949290f610d
Fingerprint 378019520f810a4c
Analysis status DONE
Considered CTI value 0
Text language
Published Oct. 30, 2024, 2:05 p.m.
Added to db Oct. 30, 2024, 3:11 p.m.
Last updated Nov. 17, 2024, 12:55 p.m.
Headline EMERALDWHALE: 15k Cloud Credentials Stolen in Operation Targeting Exposed Git Config Files
Title EMERALDWHALE: 15k Cloud Credentials Stolen in Operation Targeting Exposed Git Config Files
Detected Hints/Tags/Attributes 72/4/19
Source URLs
Redirection Url
Details Source https://malware.news/t/emeraldwhale-15k-cloud-credentials-stolen-in-operation-targeting-exposed-git-config-files/87965
URL Provider
Details Provider Source level domain
Details malware.news malware.news
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 158 ✔ Malware Analysis, News and Indicators - Latest topics https://malware.news/latest.rss 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 2 
gitfinder.sh
Details Domain 2 
ghpurl.py
Details Domain 54 
re.search
Details Domain 2 
checkuser.sh
Details Domain 2 
dumpsph.sh
Details Domain 2 
parser.sh
Details Domain 2 
dumperz.sh
Details Domain 6 
ex.sh
Details File 2 
git.txt
Details File 2 
ghpurl.py
Details File 8 
'.log
Details File 2 
ses_password.py
Details File 2 
healthy_aws_smtp.txt
Details File 2 
ses_valid.txt
Details File 6 
mail.inf
Details File 2 
smtp.txt
Details File 2 
api_sms.txt
Details IPv4 198 
1.1.1.1
Details IPv4 59 
255.255.255.255