CISA Incident Response to SUPERNOVA Malware

ronjor · Apr 22, 2021

Original release date: April 22, 2021

CISA has released AR21-112A: CISA Identifies SUPERNOVA Malware During Incident Response to provide analysis of a compromise in an organization’s enterprise network by an advance persistent threat actor. This report provides tactics, techniques, and procedures CISA observed during the incident response engagement.
CISA encourages organizations to review AR21-112A for more information.
Click to expand...

itman · Apr 22, 2021

This is a great "read." Of note:

Description

From at least March 2020 through February 2021, the threat actor connected to the entity via the entity’s Pulse Secure VPN appliance (External Remote Services [T1133]). The threat actor connected via the U.S.-based residential IP addresses listed below, which allowed them to masquerade as teleworking employees. (Note: these IP addresses belong to routers that are all similar models; based on this activity, CISA suspects that these routers were likely exploited by the threat actor.)

207.89.9[.]153

24.140.28[.]90

24.117.18[.]111

Click to expand...

Hack the routers of company employees .....

Log in or Sign up

CISA Incident Response to SUPERNOVA Malware

ronjor Global Moderator

itman Registered Member

Log in or Sign up

CISA Incident Response to SUPERNOVA Malware

ronjor Global Moderator

itman Registered Member

Useful Searches