Threat video1:00
WhiteArmor Hits Maersk OCF/LF: Detection & IOCs
WhiteArmor claims about 100 GB from Maersk's legacy OCF/LF system, and 9 detection rules, 11 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for WhiteArmor Hits Maersk OCF/LF: Detection & IOCs →
Chapters
- 0:00The hookMaersk confirmed a legacy system breach.
- 0:04The storyWhiteArmor listed Maersk on its leak site.
- 0:10Attack pathAn acquired company's legacy system was reportedly breached.
- 0:27AttributionAttributed to WhiteArmor.
- 0:32Indicators of compromise6 indicators to hunt: 2 domains, 2 URLs and 2 file names.
- 0:38MITRE ATT&CK techniques4 ATT&CK techniques, from credential access to impact.
- 0:43Remediation4 steps now: Inventory and review legacy or acquired-company platforms for exposure.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Maersk confirmed a legacy system breach.
0:05WhiteArmor listed Maersk on its leak site.
0:11An acquired company's legacy system was reportedly breached.
0:15It claims nearly 30,000 driver records.
0:18It claims roughly 100 GB taken.
0:21It posted Maersk, then demanded $5M in bitcoin.
0:28Attributed to WhiteArmor. Confidence: medium.
0:326 indicators to hunt: 2 domains, 2 URLs and 2 file names.
0:394 ATT&CK techniques, from credential access to impact.
0:434 steps now: Inventory and review legacy or acquired-company platforms for exposure.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.