Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Connect-Back, Scanner
Services Targeted	SCP SSH
Tags	SSH Superuser Operation SCP Download File Successful SSH Login Download and Execute
Associated Attack Servers	aeza.network af.mil angkasawave.net bezeqint.net cultimording.org.uk drei.com exasia.net exede.net griffin.net.uk innovatelekom.com kj4l3yh8.cn Majordomo.ru partnet.com.pl primus.ca regruhosting.ru spd-mgts.ru srasia-great.com telbo.net telenor.dk telia.com vorboss.net vultrusercontent.com wellcom.at zcrtyshop.club 1.117.70.249 1.130.12.215 1.141.195.85 1.247.129.186 2.130.47.60 3.74.194.58 3.91.21.110 4.34.57.102 4.50.179.93 4.63.124.222 4.152.152.253 5.37.18.181 5.161.42.72 5.249.214.179 6.48.114.63 6.152.105.197 8.175.30.236 8.221.212.20 12.23.46.220 12.184.160.199 13.23.199.82 13.82.215.148 13.124.116.69 14.206.25.145 15.164.25.94 16.35.190.195 17.117.201.73 17.120.184.199 18.10.229.167 18.41.27.171

Basic Information

IP Address	223.171.91.191
Domain	-
ISP	LG Uplus
Country	Korea, Republic of
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-02-24
Last seen in Akamai Guardicore Segmentation	2024-06-22

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List	Successful SSH Login
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 4 times	Successful SSH Login
/dev/shm/ifconfig was downloaded 3 times	Download File
A possibly malicious Superuser Operation was detected 16 times	Superuser Operation
Process /dev/shm/ifconfig scanned port 1234 on 51 IP Addresses	Port 1234 Scan
Process /tmp/apache2 scanned port 1234 on 51 IP Addresses 2 times	Port 1234 Scan
Process /root/apache2 scanned port 1234 on 51 IP Addresses	Port 1234 Scan
Process /root/ifconfig scanned port 1234 on 51 IP Addresses	Port 1234 Scan
Process /dev/shm/apache2 scanned port 1234 on 51 IP Addresses	Port 1234 Scan
Process /dev/shm/ifconfig started listening on ports: 1234, 8088 and 8185	Listening
Process /dev/shm/ifconfig generated outgoing network traffic to: 102.141.225.244:1234, 103.105.12.48:1234, 120.224.143.251:1234, 120.236.74.234:1234, 144.22.130.100:1234, 159.65.242.113:1234, 173.18.35.41:1234, 20.56.195.26:1234, 202.61.203.229:1234, 213.255.16.156:1234, 44.202.10.176:1234, 51.75.146.174:443, 85.105.58.118:1234 and 85.51.24.68:1234	Outgoing Connection
The file /tmp/ifconfig was downloaded and executed 7 times	Download and Execute
The file /tmp/ifconfig was downloaded and executed 4 times	Download and Execute
The file /tmp/apache2 was downloaded and executed 263 times	Download and Execute
Process /tmp/apache2 generated outgoing network traffic to: 103.90.177.102:1234, 117.16.44.111:1234, 117.80.212.33:1234, 118.41.204.72:1234, 120.224.143.251:1234, 120.236.79.182:1234, 142.250.190.100:443, 147.182.233.56:1234, 159.65.242.113:1234, 163.123.181.132:1234, 169.254.85.1:1234, 172.64.200.11:443, 172.64.201.11:443, 184.67.149.186:1234, 217.85.239.81:1234, 36.112.152.152:1234, 40.87.11.253:1234, 44.202.10.176:1234, 45.120.216.114:1234, 5.28.139.161:1234, 59.1.226.211:1234 and 82.66.109.74:1234	Outgoing Connection
Process /tmp/apache2 started listening on ports: 1234, 8087 and 8188	Listening
The file /tmp/apache2 was downloaded and executed 106 times	Download and Execute
Process /tmp/apache2 generated outgoing network traffic to: 101.35.198.225:1234, 118.218.209.149:1234, 163.123.181.132:1234, 169.254.85.1:1234, 172.64.200.11:443, 172.64.201.11:443, 20.127.87.36:1234, 31.14.115.42:1234, 5.28.139.161:1234, 61.102.42.5:1234, 78.187.13.206:1234 and 82.64.113.245:1234	Outgoing Connection
Process /tmp/apache2 started listening on ports: 1234, 8086, 8087, 8181 and 8188	Listening
./ifconfig was downloaded 2 times	Download File
The file /root/ifconfig was downloaded and executed 6 times	Download and Execute
The file /root/apache2 was downloaded and executed 104 times	Download and Execute
Process /root/apache2 generated outgoing network traffic to: 120.236.79.182:1234, 121.200.53.148:1234, 139.59.135.142:1234, 162.19.210.221:1234, 172.64.200.11:443, 172.64.201.11:443, 174.4.208.151:1234, 31.14.115.42:1234, 36.112.152.152:1234, 40.87.11.253:1234, 59.1.226.211:1234, 61.102.42.5:1234, 61.84.162.66:1234, 66.70.154.59:1234, 80.147.162.151:1234 and 85.51.217.156:1234	Outgoing Connection
Process /root/apache2 started listening on ports: 1234, 8087 and 8182	Listening
The file /root/ifconfig was downloaded and executed 6 times	Download and Execute
Process /root/ifconfig started listening on ports: 1234, 8084 and 8183	Listening
The file /root/apache2 was downloaded and executed 99 times	Download and Execute
Process /root/ifconfig generated outgoing network traffic to: 102.141.225.238:1234, 103.90.177.102:1234, 120.224.143.251:1234, 120.236.74.234:1234, 148.71.35.230:1234, 173.18.35.41:1234, 20.127.87.36:1234, 223.223.200.243:1234, 5.28.139.161:1234, 51.75.146.174:443 and 61.102.42.5:1234	Outgoing Connection
/var/tmp/ifconfig was downloaded 2 times	Download File
Process /dev/shm/apache2 generated outgoing network traffic to: 129.154.55.234:1234, 172.64.200.11:443, 172.64.201.11:443, 195.87.73.208:1234, 202.61.203.229:1234, 62.12.106.6:1234, 78.187.13.206:1234, 82.64.113.245:1234 and 85.51.24.68:1234	Outgoing Connection
Process /dev/shm/apache2 started listening on ports: 1234, 8086 and 8189	Listening
/root/ifconfig was downloaded	Download File
Connection was closed due to timeout

Associated Files

/tmp/ifconfig	SHA256: 0fc0b3ba908c52402b1d5724f87368c8e66aadbb9b472b0583c000954a21d989	327680 bytes
/var/tmp/ifconfig	SHA256: 2fd96aa6470f930f543ef665fcc62ffa4dfe6646b8f506c11b452a191800285b	2392064 bytes
/var/tmp/ifconfig	SHA256: 331f1ead3df8fed58ccf68da781f34b2f228a5c37f3bb245b836a4b49b1cf269	557056 bytes
/var/tmp/ifconfig	SHA256: 366408b99e3165dd170cf29c44e8ae63ec7d8e45052c0ca2f894c20e7243fcf0	3090368 bytes
/var/tmp/ifconfig	SHA256: 3c7a7c5e08ac88c4a76354a64b531b4f27388d24008c36d3b5c8d618bcdb5b5b	458752 bytes
/var/tmp/ifconfig	SHA256: 49fd787bb9fd2f4e5338b7548824e3017d7de9cdeff62ef1e2d64104c0604297	229376 bytes
/var/tmp/ifconfig	SHA256: 4d4961b1246328d48b365dfb4a7a062327ed9fb143cba136ab921f5afc4f2448	294912 bytes
/tmp/ifconfig	SHA256: 63ce5e408bc30df5efb4e48cb2e893e84b58da0ea31d834ce11db915f0dfaba2	32768 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files