Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	SSH
Tags	Listening Download Operation HTTP Outgoing Connection SSH Brute Force 2 Shell Commands Package Install Access Suspicious Domain Download and Execute IDS - Potential Corporate Privacy Violation Successful SSH Login SSH Download File Download and Allow Execution
Associated Attack Servers	-

Basic Information

IP Address	195.133.18.100
Domain	-
ISP	Limited Liability Company Relcom Group
Country	Russian Federation
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-03-03
Last seen in Akamai Guardicore Segmentation	2022-03-21

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List (Part of a Brute Force Attempt)	SSH Brute Force Successful SSH Login
A possibly malicious Download Operation was detected	Download Operation Package Install
A possibly malicious Package Install was detected	Download Operation Package Install
A possibly malicious Download Operation was detected	Download Operation Package Install
A possibly malicious Package Install was detected	Download Operation Package Install
Process /bin/bash generated outgoing network traffic to: 2.56.56.182:80	Outgoing Connection
Process /bin/bash attempted to access suspicious domains: viewdns.net	Access Suspicious Domain Outgoing Connection
The file /tmp/mysql.sock.lock was downloaded and granted execution privileges
The file /tmp/x86.sh was downloaded and granted execution privileges
Process /usr/bin/wget generated outgoing network traffic to: 2.56.56.182:80	Outgoing Connection
Process /usr/bin/wget attempted to access suspicious domains: viewdns.net	Access Suspicious Domain Outgoing Connection
Process /usr/local/bin/dash started listening on ports: 6628	Listening
A user logged in using SSH with the following credentials: root / **** - Authentication policy: Correct Password (Part of a Brute Force Attempt)	SSH Brute Force Successful SSH Login
A possibly malicious Download Operation was detected	Download Operation Package Install
A possibly malicious Package Install was detected	Download Operation Package Install
A possibly malicious Download Operation was detected	Download Operation Package Install
A possibly malicious Package Install was detected	Download Operation Package Install
Process /bin/bash generated outgoing network traffic to: 2.56.56.182:80	Outgoing Connection
Process /bin/bash attempted to access suspicious domains: viewdns.net	Access Suspicious Domain Outgoing Connection
/tmp/x86.sh was downloaded	Download File
Process /usr/bin/wget generated outgoing network traffic to: 2.56.56.182:80	Outgoing Connection
Process /usr/bin/wget attempted to access suspicious domains: viewdns.net	Access Suspicious Domain Outgoing Connection
Process /tmp/x86_64 started listening on ports: 6628	Listening
The file /tmp/x86_64 was downloaded and executed 4 times	Download and Execute
Process /tmp/x86_64 generated outgoing network traffic to: 2.56.56.182:5438	Outgoing Connection
Process /tmp/x86_64 attempted to access suspicious domains: viewdns.net	Access Suspicious Domain Outgoing Connection
IDS detected Potential Corporate Privacy Violation : Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set	IDS - Potential Corporate Privacy Violation
IDS detected Potential Corporate Privacy Violation : Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set	IDS - Potential Corporate Privacy Violation
IDS detected Potential Corporate Privacy Violation : Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 6 or 7 set	IDS - Potential Corporate Privacy Violation
IDS detected Potential Corporate Privacy Violation : DNS Update From External net	IDS - Potential Corporate Privacy Violation
Process /tmp/x86_64 started listening on ports: 43704	Listening
Connection was closed due to timeout

Akamai Security Intelligence Group

Guardicore CENTRA

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow