• 0 Posts
  • 251 Comments
Joined 2 months ago
cake
Cake day: August 29th, 2024

help-circle


  • If you don’t use Microsoft Azure cloud services then it shouldn’t matter, for now. Might want to just avoid running those for a little while.

    The article also says:

    It’s unclear precisely how the compromised botnet devices are being initially infected. Whatever the cause, once devices are exploited, the threat actors often take the following actions:

    • Download Telnet binary from a remote File Transfer Protocol (FTP) server
    • Download xlogin backdoor binary from a remote FTP server
    • Utilize the downloaded Telnet and xlogin binaries to start an access-controlled command shell on TCP port 7777
    • Connect and authenticate to the xlogin backdoor listening on TCP port 7777
    • Download a SOCKS5 server binary to router
    • Start SOCKS5 server on TCP port 11288.

    So maybe setting up some firewall rules could also help prevent further problems.