Executive Summary This report summarizes activity observed on the DShield sensor between September 12 and 15, 2024, targeting both web and SSH services. Multiple techniques, including SSH brute-force attacks and web-based automated reconnaissance attempts, were identified. The attackers primarily leveraged poorly configured services and default credentials across both attack surfaces.
As I’ve progressed through my internship with the Internet Storm Center, my interest in cyber threat intelligence has grown significantly, especially in the area of CVE reporting and impact assessment. This isn’t just theoretical; I’ve applied these concepts using tools like ELK and OpenCTI. Additionally, I’m
Executive Summary The following report provides an in-depth analysis of malicious activities conducted by IP 145.224.101.116, associated with SpaceX's Starlink ASNAME. This IP was specifically chosen for further investigation due to its association with the SpaceX ASN, which is an unusual and interesting origin for
Executive Summary This report examines the crypto miner activity detected on the Digital Ocean based [1]DShield honeypot, breaking down the attackers' attack patterns, techniques, and payloads. This analysis also maps relevant [2]MITRE ATT&CK techniques, providing a clear view of the adversaries' strategies. 1. Overview
Executive Summary After monitoring a few months of attacks on my home network's [1]DShield honeypot, it became evident that most of these incidents were driven by automated scripts or bot behavior, with most sessions concluding within a minute. While this provided some insight, the predictability and repetitiveness
