Threat Actor Claims Responsibility For IBM and Stanford University Hack

CloudSEK used its synthetic intelligence (AI)-powered electronic risk system XVigil to discover a submit on a cybercrime forum mentioning open resource automation server platform Jenkins as 1 of the TTP (strategies, tactics, and methods) utilized by a menace actor (TA) in attacks against IBM and Stanford College.

The module reportedly has hidden desktop takeover abilities that would be used by the TA to get clicks on advertisements. 

The submit on the English-speaking discussion board was spotted by CloudSEK on Could 07 2022 and contained a sample screenshot as proof of their claimed obtain to a Jenkins dashboard.

From a technological standpoint, the TA encountered a Jenkins dashboard bypass that contained interior hosts and scripts, jointly with database credentials and logins.

The hacker would have utilized research engines like Shodan to concentrate on port 9443 of the compromised company’s general public asset and then employed a non-public script for fuzzing to get susceptible circumstances to exploit rproxy misconfiguration bypass.

According to further posts by the exact person on the cybercrime discussion board, the actor reported they beforehand also targeted IBM Tech Company, particularly internal administrators’ scripts and firewall configurations for interior networks.

Describing the attacks, CloudSEK claimed that TTP used by the menace actor could be utilized by many others to carry out related exploits.

“Modules like these can allow persistence and complex ransomware attacks. Danger actors may well transfer laterally, infecting the network, to retain persistence and steal credentials,” the security professionals wrote.

“Since password reuse is a typical apply, actors could [also] leverage exposed qualifications to accessibility other accounts of the consumer.”

For context, the TA also claimed responsibility for hacking Jozef Safarik University in Slovakia and Stanford University.

Experiences from XVigil recommended federal government access to the domains was uncovered from many nations around the world, which includes Ukraine, United Arab Emirates, Pakistan and Nepal.

Primarily based on underground conversations, CloudSEK researchers said they expect this malicious campaign to ramp up bot infection tries.

Some parts of this report are sourced from:
www.infosecurity-magazine.com