AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Domains/Urls

beraskencur.site

magento.ink

solidmonpe.com

wibu-bau-bawang.online

IP Address

104.194.158.65

104.248.131.53

109.224.53.140

138.68.244.146

141.164.58.87

147.182.224.216

154.93.37.228

162.243.175.162

173.212.247.23

185.21.136.6

192.210.183.17

198.23.185.234

45.88.188.140

72.61.89.179

88.119.167.57

88.80.150.232

93.93.112.57

Hash

1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a

27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704

2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e

44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879

76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5

9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e

b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac

c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343

d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd

d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa

Detection Query 1 :

domainname like "wibu-bau-bawang.online" or url like "wibu-bau-bawang.online" or siteurl like "wibu-bau-bawang.online" or domainname like "beraskencur.site" or url like "beraskencur.site" or siteurl like "beraskencur.site" or domainname like "solidmonpe.com" or url like "solidmonpe.com" or siteurl like "solidmonpe.com" or domainname like "magento.ink" or url like "magento.ink" or siteurl like "magento.ink"

Detection Query 2 :

dstipaddress IN ("154.93.37.228","162.243.175.162","192.210.183.17","198.23.185.234","141.164.58.87","104.248.131.53","88.119.167.57","93.93.112.57","147.182.224.216","72.61.89.179","88.80.150.232","45.88.188.140","173.212.247.23","104.194.158.65","138.68.244.146","185.21.136.6","109.224.53.140") or srcipaddress IN ("154.93.37.228","162.243.175.162","192.210.183.17","198.23.185.234","141.164.58.87","104.248.131.53","88.119.167.57","93.93.112.57","147.182.224.216","72.61.89.179","88.80.150.232","45.88.188.140","173.212.247.23","104.194.158.65","138.68.244.146","185.21.136.6","109.224.53.140")

Detection Query 3 :

sha256hash IN ("2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e","1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a","d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd","76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5","d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa","44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879","c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343","9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e","27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704","b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac")