Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Connect-Back, Scanner
Services Targeted	SCP SSH
Tags	Outgoing Connection HTTP SSH Log Tampering SCP Download File Access Suspicious Domain Port 22 Scan Successful SSH Login Download and Execute 2 Shell Commands
Associated Attack Servers	159.203.90.161 178.128.158.153 182.74.79.227

Basic Information

IP Address	167.71.239.181
Domain	-
ISP	The Associated Press
Country	United States
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-01-03
Last seen in Akamai Guardicore Segmentation	2023-10-19

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List	Successful SSH Login
A user logged in using SSH with the following credentials: root / **** - Authentication policy: Correct Password	Successful SSH Login
/tmp/z was downloaded	Download File
A user logged in using SSH with the following credentials: root / **** - Authentication policy: Correct Password	Successful SSH Login
History File Tampering detected from /usr/sbin/sshd	Log Tampering
Process /bin/bash generated outgoing network traffic to: 178.128.158.153:80	Outgoing Connection
Process /bin/bash attempted to access suspicious domains: archworks.com.br	Outgoing Connection Access Suspicious Domain
/tmp/.fr/scL.tgz was downloaded	Download File
Process /bin/bash generated outgoing network traffic to: 10.0.0.10:22, 10.0.0.11:22, 10.0.0.12:22, 10.0.0.13:22, 10.0.0.14:22, 10.0.0.15:22, 10.0.0.16:22, 10.0.0.17:22, 10.0.0.18:22, 10.0.0.19:22, 10.0.0.1:22, 10.0.0.20:22, 10.0.0.21:22, 10.0.0.22:22, 10.0.0.23:22, 10.0.0.24:22, 10.0.0.25:22, 10.0.0.26:22, 10.0.0.27:22, 10.0.0.28:22, 10.0.0.29:22, 10.0.0.2:22, 10.0.0.30:22, 10.0.0.31:22, 10.0.0.32:22, 10.0.0.33:22, 10.0.0.34:22, 10.0.0.35:22, 10.0.0.36:22, 10.0.0.37:22, 10.0.0.38:22, 10.0.0.39:22, 10.0.0.3:22, 10.0.0.40:22, 10.0.0.41:22, 10.0.0.42:22, 10.0.0.43:22, 10.0.0.44:22, 10.0.0.45:22, 10.0.0.46:22, 10.0.0.47:22, 10.0.0.48:22, 10.0.0.49:22, 10.0.0.4:22, 10.0.0.50:22, 10.0.0.51:22, 10.0.0.52:22, 10.0.0.53:22, 10.0.0.54:22, 10.0.0.55:22, 10.0.0.56:22, 10.0.0.57:22, 10.0.0.58:22, 10.0.0.59:22, 10.0.0.5:22, 10.0.0.60:22, 10.0.0.61:22, 10.0.0.62:22, 10.0.0.63:22, 10.0.0.64:22, 10.0.0.65:22, 10.0.0.66:22, 10.0.0.67:22, 10.0.0.68:22, 10.0.0.69:22, 10.0.0.6:22, 10.0.0.70:22, 10.0.0.71:22, 10.0.0.72:22, 10.0.0.73:22, 10.0.0.74:22, 10.0.0.75:22, 10.0.0.76:22, 10.0.0.77:22, 10.0.0.78:22, 10.0.0.79:22, 10.0.0.7:22, 10.0.0.80:22, 10.0.0.81:22, 10.0.0.82:22, 10.0.0.83:22, 10.0.0.84:22, 10.0.0.85:22, 10.0.0.86:22, 10.0.0.87:22, 10.0.0.88:22, 10.0.0.89:22, 10.0.0.8:22, 10.0.0.90:22, 10.0.0.91:22, 10.0.0.92:22, 10.0.0.93:22, 10.0.0.94:22, 10.0.0.95:22, 10.0.0.96:22, 10.0.0.97:22, 10.0.0.98:22, 10.0.0.9:22 and 167.71.239.181:80	Outgoing Connection
Process /bin/bash scanned port 22 on 98 IP Addresses	Port 22 Scan
The file /tmp/.fr/.sc/b was downloaded and executed 22 times	Download and Execute
Connection was closed due to timeout

Associated Files

/tmp/.fr/scL.tgz	SHA256: 586cf1876c4ae6c708f94b1f1e2b6e254f1abedc8082d2b8514f442eeb4157f5	2132558 bytes
/tmp/pax.txt	SHA256: 851eca767fbe3ac667657717a4abd2e9f7e86db9386f52f65ae4453cb618e913	1036 bytes
/tmp/pax.txt	SHA256: b3b1275f5ee8401efd35ecbc55ad25fee7e943ff3c37fadc2d0e0dc33b832cc3	37742 bytes
/tmp/pax.txt	SHA256: b698cd03fd5fba64c95e8224635fc80a3729106f744cfce67f97ba9e9558e17c	7416 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files