Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top…
Tags
country: Russia
attack-pattern: Data Direct Models Code Repositories - T1213.003 Code Repositories - T1593.003 Credentials - T1589.001 Exploits - T1587.004 Exploits - T1588.005 Kerberoasting - T1558.003 Malware - T1587.001 Malware - T1588.001 Multi-Factor Authentication - T1556.006 Powershell - T1059.001 Remote Desktop Protocol - T1021.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Brute Force - T1110 Kerberoasting - T1208 Powershell - T1086 Remote Desktop Protocol - T1076
Show in Graph
Common Information
Type Value
UUID eadb204d-fc35-4d3e-aebe-286a353d76b5
Fingerprint 25601dd99a169e8c
Analysis status DONE
Considered CTI value 2
Text language
Published Sept. 1, 2022, midnight
Added to db Feb. 18, 2023, 12:52 a.m.
Last updated Dec. 19, 2024, 5:25 a.m.
Headline Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation & an Affiliate of Russia’s Evil Corp Gang Suspected, Reports eSentire
Title Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top…
Detected Hints/Tags/Attributes 117/2/5
Source URLs
Redirection Url
Details Source https://www.esentire.com/blog/hacker-infrastructure-used-in-cisco-breach-discovered-attacking-a-top-workforce-management-corporation-russias-evil-corp-gang-suspected-reports-esentire
URL Provider
Details Provider Source level domain
Details esentire.com www.esentire.com
Attributes
Details Type #Events CTI Value
Details Domain 113 
exploit.in
Details File 1 
c:\windows\system32\findstr.exe
Details Mandiant Uncategorized Groups 26 
UNC2165
Details Mandiant Uncategorized Groups 21 
UNC2447
Details Deprecated Microsoft Threat Actor Naming Taxonomy (Groups in development) 4 
DEV-0365