Anonymous Sudan Continues to Attack

Indicators of Compromise

APT Groups

Notes

<div><font><b>How to Prevent a Killnet Attack&nbsp;</b></font></div><div><br></div><div>Firstly, we need to pay attention to two main defense tactics. One is enforcing strong password policies that can withstand basic brute-force credential attacks, and the second is to have a proper strategy for fighting off DDoS attacks.</div><div><br></div><div>The other defensive tactics are listed below:</div><div><br></div><div><ul><li>Purchase DDoS mitigation services from an Internet Service Provider (ISP), Content Delivery Network (CDN), or Web-Application Firewall (WAF) provider.</li><li>Deploy multi-factor authentication (MFA) mechanism for all remote accesses</li><li>Use blocklisting known Killnet-related IoC, such as IP addresses used by Killnet attacks.</li><li>Enable the DMZ (Demilitarized Zone) for internet-facing entities.</li><li>Employ DDoS protection via web bot detection techniques.</li><li>Reduce attack surfaces and make it easier with ASM (Attack Surface Management) platforms.</li><li>Get the CTI (cyber threat intelligence) feeds that monitor dark web information to identify and predict potential threats and provide actionable intelligence data for your organization.</li><li>Configure web servers and APIs with security modules to optimize performance during a web traffic spike.</li><li>Perform stress tests on all critical services for their ability to handle resource exhaustion attacks</li><li>Create and practice IRP (Incident Response Plan) for the worst case, which resulted in temporary downtime.</li></ul><div><div><font><b>Learn What Hackers Talk About Your Company With SOCRadar</b></font></div><div><br></div><div>The fact that Telegram is a legit messaging app used by millions gave hackers a chance to conceal themselves and follow their malicious agenda. More and more threat actors use Telegram for communication and announcements, and it has become the main hub for <a href="https://">threat actors.</a></div></div><div><br></div></div>

Mitigation

<div style="box-sizing: border-box; margin-top: 0px; margin-bottom: 1rem; font-weight: bold; line-height: 1.2; color: rgb(66, 66, 102); letter-spacing: normal;"><strong style="box-sizing: border-box; letter-spacing: 0px;"><font style="">MITRE Map</font></strong></div><table style="box-sizing: border-box; border-collapse: collapse; margin-bottom: 28px; border-top: 1px solid rgb(222, 226, 230); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; color: rgb(96, 96, 128); font-family: &quot; font-size: 16px;"><tbody style="box-sizing: border-box;"><tr style="box-sizing: border-box; border-bottom: 1px solid rgb(222, 226, 230);"><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><strong style="box-sizing: border-box; letter-spacing: 0px;"><font>Reconnaissance&nbsp;</font></strong></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><strong style="box-sizing: border-box; letter-spacing: 0px;"><font>Resource Development</font></strong></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><strong style="box-sizing: border-box; letter-spacing: 0px;"><font>Credential Access&nbsp;</font></strong></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><strong style="box-sizing: border-box; letter-spacing: 0px;"><font>Impact</font></strong></p></td></tr><tr style="box-sizing: border-box; border-bottom: 1px solid rgb(222, 226, 230);"><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><font>T1595: Active Scanning&nbsp;</font></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><font>T1583: Acquire Infrastructure&nbsp;</font></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><font>T1110: Brute Force&nbsp;</font></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><font>T1498: Network Denial of Service</font></p></td></tr><tr style="box-sizing: border-box; border-bottom: 1px solid rgb(222, 226, 230);"><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><font>T1589: Gather Victim Identity Information&nbsp;</font></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><font>T1584: Compromise Infrastructure&nbsp;</font></p></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem 1.5rem 0.75rem 0.75rem; border: 2px solid rgb(233, 236, 239);"><font>&nbsp;</font></td><td style="box-sizing: border-box; vertical-align: top; padding: 0.75rem; border: 2px solid rgb(233, 236, 239);"><p style="box-sizing: border-box; margin-bottom: 1rem;"><font>T1489: Service Stop</font></p></td></tr></tbody></table><br><div><div><font><b>Primary Killnet Tactics</b></font></div><div><br></div><div><font>Brute-force dictionary attacks against:</font></div><div><font><br></font></div><div><font>SSH (port 22) primarily targets the root account</font></div><div><font>Minecraft and TeamSpeak servers</font></div><div><font>DDoS attacks on the OSI model:</font></div><div><font><br></font></div><div><font>layer 4 (SYN flood attacks)</font></div><div><font>layer 7 (high volume POST/GET requests) to cause resource exhaustion and system failure.</font></div><div><font>In various Telegram groups, they collaborate with the members who are instructed to use IP stresser-for-hire tools such as Crypto Stresser, DDG Stresser, Instant-Stresser, and Stresser.ai. Moreover, several scripts are used during their attacks. Some of them are CC-attack, MDDoS, Low Orbit Ion Cannon (LOIC), KARMA, and Dummy.</font></div></div>