Threat video1:00
Beget Wiper Erases VPS and S3 Data: Detection & IOCs
Attackers wiped Beget's VPS, S3 and Kubernetes data and VPS backups. Detect it with 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for Beget Wiper Erases VPS and S3 Data: Detection & IOCs →
Chapters
- 0:00The hookAn attacker destroyed Beget's cloud data.
- 0:04The storyAttackers reached the management layer.
- 0:10Attack pathBeget reported an unnamed attacker reached management systems.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:42Remediation4 steps now: Rotate passwords, API/access keys, SSH keys and any credentials stored.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00An attacker destroyed Beget's cloud data.
0:05Attackers reached the management layer.
0:07Beget disconnected all servers from the network.
0:11Beget reported an unnamed attacker reached management systems.
0:15They issued commands, then ran data-zeroing scripts.
0:18Cloud data, disk-image backups, CDN settings destroyed.
0:22Outages hit; Beget disconnected all servers.
0:28No threat actor is attributed. Confidence: low.
0:32No malicious indicators were published.
0:387 ATT&CK techniques, from initial access to impact.
0:424 steps now: Rotate passwords, API/access keys, SSH keys and any credentials stored.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.