Threat video1:00
DreamHost File Manager FTP/SFTP Breach: Detection & IOCs
A third-party flaw behind DreamHost's File Manager leaked FTP/SFTP and webmail logins. Covered by 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for DreamHost File Manager FTP/SFTP Breach: Detection & IOCs →
Chapters
- 0:00The hookAbout File Manager flaw exposed login credentials.
- 0:04The storyCredentials exposed over 3-month window.
- 0:11Attack pathAttacker exploited File Manager to harvest credentials.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise4 indicators to hunt: 1 domain, 2 URLs and 1 hosting.
- 0:36MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to collection.
- 0:41Remediation6 steps now: Reset FTP/SFTP and email passwords via the DreamHost control panel.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About File Manager flaw exposed login credentials.
0:05Credentials exposed over 3-month window.
0:08Passwords reset; systems restored.
0:12Attacker exploited File Manager to harvest credentials.
0:15FTP/SFTP and webmail systems were compromised.
0:25No threat actor is attributed. Confidence: low.
0:304 indicators to hunt: 1 domain, 2 URLs and 1 hosting.
0:365 ATT&CK techniques, from initial access to collection.
0:416 steps now: Reset FTP/SFTP and email passwords via the DreamHost control panel.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.