Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Connect-Back, Scanner
Services Targeted	SCP SSH
Tags	SSH Superuser Operation SCP Download File Successful SSH Login Download and Execute
Associated Attack Servers	airtel.in alter.net backblaze.com hydro.com jiketoys.com.cn kj4l3yh8.cn Majordomo.ru sileman.net.pl 1.101.34.11 3.110.84.129 5.161.42.72 6.4.48.77 7.164.220.148 9.169.244.130 11.212.116.211 12.33.147.123 12.76.61.225 12.89.10.104 13.90.116.248 17.182.96.162 18.129.118.169 20.141.185.205 20.195.231.146 20.226.25.68 23.175.177.204 24.233.26.241 30.4.54.45 30.189.135.108 31.39.246.235 31.160.203.90 32.240.63.15 33.205.232.200 35.89.78.207 37.11.123.75 37.25.54.162 37.142.52.6 38.119.167.206 42.193.137.44

Basic Information

IP Address	223.171.91.127
Domain	-
ISP	LG Uplus
Country	Korea, Republic of
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-02-26
Last seen in Akamai Guardicore Segmentation	2024-05-07

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List	Successful SSH Login
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 2 times	Successful SSH Login
A possibly malicious Superuser Operation was detected 12 times	Superuser Operation
The file /etc/ifconfig was downloaded and executed 5 times	Download and Execute
The file /etc/apache2 was downloaded and executed 808 times	Download and Execute
Process /etc/ifconfig scanned port 1234 on 33 IP Addresses	Port 80 Scan Port 1234 Scan
Process /etc/ifconfig scanned port 1234 on 53 IP Addresses	Port 80 Scan Port 1234 Scan
Process /etc/ifconfig scanned port 80 on 33 IP Addresses	Port 80 Scan Port 1234 Scan
Process /bin/nc.openbsd scanned port 1234 on 33 IP Addresses	Port 1234 Scan
Process /tmp/apache2 scanned port 1234 on 33 IP Addresses	Port 1234 Scan
Process /root/ifconfig scanned port 1234 on 33 IP Addresses	Port 1234 Scan
Process /etc/ifconfig generated outgoing network traffic to: 101.192.188.237:80, 101.42.90.177:1234, 103.105.12.48:1234, 108.154.27.20:80, 110.226.151.188:80, 110.93.6.75:80, 116.134.185.219:80, 118.41.204.72:1234, 12.151.121.74:80, 120.236.78.194:1234, 121.89.114.218:80, 123.132.238.210:1234, 123.177.238.177:80, 124.115.231.214:1234, 128.96.226.47:80, 129.23.22.253:80, 131.153.196.190:80, 132.113.232.67:80, 133.221.116.238:80, 134.116.102.124:80, 134.194.75.119:80, 149.169.242.212:80, 150.239.160.247:80, 155.41.185.116:80, 161.35.79.199:1234, 161.70.98.32:1234, 163.62.125.76:80, 17.213.190.194:80, 172.64.200.11:443, 172.64.201.11:443, 173.18.35.41:1234, 174.240.54.156:80, 183.125.89.247:80, 185.210.144.122:1234, 187.202.237.181:80, 187.5.5.94:80, 190.138.240.233:1234, 191.242.182.210:1234, 192.85.63.39:80, 194.72.249.55:80, 20.141.185.205:1234, 202.151.251.144:80, 202.242.196.252:80, 203.8.34.49:80, 206.189.25.255:1234, 208.131.198.165:80, 209.216.177.158:1234, 209.216.177.238:1234, 212.57.36.20:1234, 216.241.33.68:80, 220.243.148.80:1234, 222.134.240.92:1234, 223.171.91.160:1234, 223.171.91.191:1234, 244.19.44.16:80, 246.70.121.123:80, 248.89.239.146:80, 250.207.35.195:80, 35.144.36.155:80, 37.64.203.138:80, 39.175.68.100:1234, 42.182.29.97:80, 43.242.247.139:1234, 46.181.158.1:80, 49.233.159.222:1234, 5.101.1.21:80, 51.75.146.174:443, 52.131.32.110:1234, 58.96.93.185:80, 59.3.186.45:1234, 59.64.77.208:80, 61.10.164.228:80, 61.84.162.66:1234, 62.12.106.5:1234, 74.226.215.140:80, 75.36.10.133:80, 82.149.112.170:1234, 83.45.39.227:80, 83.97.157.84:80, 84.204.148.99:1234, 85.105.82.39:1234, 89.105.241.106:80, 89.180.249.30:80, 9.76.179.137:80, 93.231.42.128:80, 95.211.11.231:80 and 99.25.93.29:80	Outgoing Connection
Process /etc/ifconfig started listening on ports: 1234, 8082 and 8189	Listening
The file /tmp/ifconfig was downloaded and executed 6 times	Download and Execute
The file /tmp/apache2 was downloaded and executed 14 times	Download and Execute
Process /tmp/apache2 generated outgoing network traffic to: 172.64.200.11:443	Outgoing Connection
./ifconfig was downloaded	Download File
The file /root/ifconfig was downloaded and executed 5 times	Download and Execute
The file /root/apache2 was downloaded and executed 10 times	Download and Execute
Process /root/ifconfig generated outgoing network traffic to: 172.64.200.11:443	Outgoing Connection
Process /etc/ifconfig scanned port 80 on 53 IP Addresses	Port 80 Scan Port 1234 Scan
The file /var/tmp/ifconfig was downloaded and executed 5 times	Download and Execute
The file /var/tmp/apache2 was downloaded and executed 12 times	Download and Execute
The file /root/ifconfig was downloaded and executed 5 times	Download and Execute
The file /root/apache2 was downloaded and executed 19 times	Download and Execute
The file /etc/apache2 was downloaded and executed 51 times	Download and Execute
The file /etc/ifconfig was downloaded and executed 5 times	Download and Execute
Connection was closed due to timeout

Associated Files

/var/tmp/ifconfig	SHA256: 003fc3b1c6259d744b011cde32a47e8cb0b00708ebec1465839b9c14279bc70b	262144 bytes
/tmp/ifconfig	SHA256: 0fc0b3ba908c52402b1d5724f87368c8e66aadbb9b472b0583c000954a21d989	327680 bytes
/var/tmp/ifconfig	SHA256: 1118f58badaea9c524290c7ac9bee6703ff6656960121dc52bdb9c378775276a	3109968 bytes
/var/tmp/ifconfig	SHA256: 2aacc3f6c14a2bd120ce9f7cab7af1f4d3e207bea33d56f02a14f75613a7930c	786432 bytes
/var/tmp/ifconfig	SHA256: 366408b99e3165dd170cf29c44e8ae63ec7d8e45052c0ca2f894c20e7243fcf0	3090368 bytes
/root/apache2	SHA256: 4028880b6d6318bb68703ad18cbc062f79aff02897692265a16c5a1e140a3d20	3087196 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files