Excerpt
The VBScript then dropped the legitimate Remote Monitoring and Management (RMM) tool ManageEngine Endpoint Central.
Fareed included the IOCs for the following Endpoint Central server IP addresses:
202.61.160.208
202.61.160.202
202.61.160.201
202.61.160.…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Netresec on netresec.com.
More from Netresec2
- CNCMachineRMS C2 ProtocolNetresec · Published 21 Aug
- PureLogs, PureRAT and misleading zgRATNetresec · Published 27 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
