Threat video1:00
Copeland XWEB PRO Refrigerator Botnet: Detection & IOCs
Default-credential admins made 743 setpoint writes on 31 XWEB controllers. 9 detection rules, 18 IOCs, 6 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for Copeland XWEB PRO Refrigerator Botnet: Detection & IOCs →
Chapters
- 0:00The hookFactory default logins wrote 743 parameters.
- 0:05The storyTwo sessions used default credentials.
- 0:11Attack pathSTRIKE reported internet-reachable controllers.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromise18 indicators to hunt: 16 IPs and 2 hostings.
- 0:38MITRE ATT&CK techniques6 ATT&CK techniques, from resource development to impact.
- 0:43Remediation5 steps now: Change the default Administrator password and any other default credentials.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Factory default logins wrote 743 parameters.
0:05Two sessions used default credentials.
0:08They read 31 devices.
0:11STRIKE reported internet-reachable controllers.
0:14Factory Administrator credentials were unchanged.
0:17Then they wrote setpoints across 31 devices.
0:20Three controllers sent outbound spam.
0:23Two panels became tunnel and proxy exits.
0:28No threat actor is attributed. Confidence: low.
0:3318 indicators to hunt: 16 IPs and 2 hostings.
0:396 ATT&CK techniques, from resource development to impact.
0:435 steps now: Change the default Administrator password and any other default credentials.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.