Threat video1:00
BO Team Black Owl Supply Chain Attack: Detection & IOCs
BO Team moved from Log4Shell on VMware vCenter to a developer's code-signing servers. Track it with 9 detection rules, 25 IOCs and a free Splunk SPL rule.
Read the full threat intel for BO Team Black Owl Supply Chain Attack: Detection & IOCs →
Chapters
- 0:00The hookDeveloper infiltrated: 24 tactics, attack halted.
- 0:04The storyFound inside terminal servers.
- 0:10Attack pathSSH brute force and Log4Shell escalated access.
- 0:26AttributionAttributed to BO Team.
- 0:30Indicators of compromise21 indicators to hunt: 3 IPs, 4 domains and 9 MD5 hashes, and more.
- 0:38MITRE ATT&CK techniques24 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation5 steps now: Block and hunt for the IOCs in this record.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Developer infiltrated: 24 tactics, attack halted.
0:05Found inside terminal servers.
0:07Then signing servers were compromised.
0:11SSH brute force and Log4Shell escalated access.
0:14They harvested credentials from domain controllers.
0:18Signing servers fell to backdoor installation.
0:21Supply chain poisoning prepared, then intercepted.
0:26Attributed to BO Team. Confidence: medium.
0:3121 indicators to hunt: 3 IPs, 4 domains and 9 MD5 hashes, and more.
0:3824 ATT&CK techniques, from initial access to command and control.
0:445 steps now: Block and hunt for the IOCs in this record.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.