🐾 - 🚨 Outgoing connection ↗ 🎛 Cobalt Strike C2 server linked to Ryuk activity

SID: 3314787Rev: 10 views
Sourcepawpatrules
CreatedNovember 30, 2020
UpdatedNovember 30, 2020
Classificationtrojan-activity
alert ip any any -> 209.141.49.233 any (msg:"🐾 - 🚨 Outgoing connection ↗ 🎛 Cobalt Strike C2 server linked to Ryuk activity"; reference:url,https://www.cert.ssi.gouv.fr/ioc/CERTFR-2020-IOC-005/; reference:url,https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk; metadata:created_at 2020_11_30, updated_at 2020_11_30; sid:3314787; rev:1; classtype:trojan-activity;)

References

urlhttps://www.cert.ssi.gouv.fr/ioc/CERTFR-2020-IOC-005/
urlhttps://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
urlhttps://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk

Metadata

created at2020_11_30
updated at2020_11_30

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!