Threat video1:00
FSB Center 16 Routers, Turla, Daxin: Detection & IOCs
FSB Center 16 abuses poorly configured routers as Turla, Daxin and GoldenEyeDog strike; 9 detection rules, 21 IOCs and a free Splunk SPL rule.
Read the full threat intel for FSB Center 16 Routers, Turla, Daxin: Detection & IOCs →
Chapters
- 0:00The hookFour APT groups active now.
- 0:04The storyDigiCert was breached; code-signing keys stolen.
- 0:10Attack pathSupport chat lure deploys malicious archive.
- 0:22AttributionAttributed to FSB Center 16.
- 0:27Indicators of compromise9 indicators to hunt: 2 domains, 2 SHA-256 hashes and 4 file names, and more.
- 0:36MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation4 steps now: Upgrade network devices to SNMPv3 and disable legacy SNMP versions.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Four APT groups active now.
0:05DigiCert was breached; code-signing keys stolen.
0:11Support chat lure deploys malicious archive.
0:14Analyst opens, two workstations compromised.
0:17Stolen code-signing certificates now weaponized.
0:23Attributed to FSB Center 16. Confidence: medium.
0:289 indicators to hunt: 2 domains, 2 SHA-256 hashes and 4 file names, and more.
0:3616 ATT&CK techniques, from resource development to command and control.
0:424 steps now: Upgrade network devices to SNMPv3 and disable legacy SNMP versions.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.