{
  "name": "Threat Actors' Systems Can Also Be Exposed and Used by Other Threat Actors",
  "slug": "threat-actors-systems-can-also-be-exposed-and-used-by-other-threat-actors",
  "description": "This report discusses a case where a CoinMiner threat actor's proxy server, used to access an infected botnet, became the target of a ransomware threat actor's Remote Desktop Protocol (RDP) scan attack. The ransomware threat actor successfully breached the proxy server and distributed ransomware to the CoinMiner's botnet. The report analyzes the sequence of events and explores the possibility of the attack being intentional or accidental.",
  "published": "2024-06-06T05:22:23+00:00",
  "created_at": "2024-06-06T05:22:23+00:00",
  "modified_at": "2024-06-06T06:06:38+00:00",
  "created_at_opencti": "2024-06-06T05:22:23+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-06-06",
    "backdoor.oldrea",
    "botnet",
    "coinminer",
    "havex",
    "phobos",
    "proxy",
    "ransomware",
    "rdp"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "46.59.214.14"
      },
      {
        "id": "",
        "name": "47.99.155.111"
      },
      {
        "id": "",
        "name": "46.59.210.69"
      },
      {
        "id": "",
        "name": "223.223.188.19"
      },
      {
        "id": "",
        "name": "185.141.26.116"
      },
      {
        "id": "",
        "name": "84.46.22.158"
      },
      {
        "id": "",
        "name": "http://84.46.22.158:7000"
      },
      {
        "id": "",
        "name": "http://46.59.214.14:7000"
      },
      {
        "id": "",
        "name": "http://46.59.210.69:7000"
      },
      {
        "id": "",
        "name": "http://185.141.26.116/winupdate.css"
      },
      {
        "id": "",
        "name": "http://185.141.26.116/stats.php"
      },
      {
        "id": "",
        "name": "http://185.141.26.116/hotfixl.ico"
      },
      {
        "id": "",
        "name": "m.mymst.top"
      },
      {
        "id": "",
        "name": "frp.mymst007.top"
      },
      {
        "id": "",
        "name": "d.mymst.top"
      },
      {
        "id": "",
        "name": "svchost.com"
      },
      {
        "id": "",
        "name": "de374c1b9a05c2203e66917202c42d11eac4368f635ccaaadf02346035e82562"
      },
      {
        "id": "",
        "name": "bc12d3944a21898a2184c190b1ccf141aa38a2ec37f168ff9711e37296afe87c"
      },
      {
        "id": "",
        "name": "9ac07d483ed3e055f48dbf031889e51e055bddf16058abb0239af1f0a9cb15dd"
      },
      {
        "id": "",
        "name": "9933bd1c96391353eea9986844d283c066d290e3a57df8a4871b4ddc41408d76"
      },
      {
        "id": "",
        "name": "90b5cd03b6de6584d47f5ab2d9cbd3eed3ed68d7db4e806b1e327d59ec0a6cde"
      },
      {
        "id": "",
        "name": "8ef1fa3f0ce9bb29a5a676a0ca7af67dc554617a8595b1043d1eb9176c248934"
      },
      {
        "id": "",
        "name": "8c57b97b04d7eabbae651c3400a5e6b897aea1ae8964507389340c44b99c523a"
      },
      {
        "id": "",
        "name": "82dd3926a416016bb5747eab624285c5013ce8ea5a8ae017027bd5c8181d3174"
      },
      {
        "id": "",
        "name": "64788b6f74875aed53ca80669b06f407e132d7be49586925dbb3dcde56cbca9c"
      },
      {
        "id": "",
        "name": "5e85446910e732111ca9ac90f9ed8b1dee13c3314d2c5117dcf672994ce73bd6"
      },
      {
        "id": "",
        "name": "4de048ad33f0a710a226d193f92f20417da5ba3628f79b0e25cbe83b0c979fc0"
      },
      {
        "id": "",
        "name": "26a3395a4115355e897a7daf04551eba5e62da661d8dbae7c99205a2e74d24ba"
      },
      {
        "id": "",
        "name": "1e5a90b5dcd4768964454cdf659620f5939464c6073f1dfc5d9306a869b609d1"
      },
      {
        "id": "",
        "name": "0a5be1c9541e0fadce5f1928d3bb95367baef9ce59d487688662b100e88aabf5"
      },
      {
        "id": "",
        "name": "e71cda5e7c018f18aefcdfbce171cfeee7b8d556e5036d8b8f0864efc5f2156b"
      },
      {
        "id": "",
        "name": "816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019"
      },
      {
        "id": "",
        "name": "7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26"
      },
      {
        "id": "",
        "name": "205818e10c13d2e51b4c0196ca30111276ca1107fc8e25a0992fe67879eab964"
      }
    ],
    "malware": [
      {
        "id": "8701e31f-3978-49c9-9cd1-16c3769a0472",
        "name": "Ransomware",
        "slug": "ransomware"
      },
      {
        "id": "legacy:malware:47258c1d5ae1c540",
        "name": "Havex",
        "slug": "havex"
      },
      {
        "id": "8242fbb8-3e2b-4cf2-ad1d-75b9baf06540",
        "name": "Backdoor.Oldrea - S0093",
        "slug": "backdooroldrea-s0093"
      },
      {
        "id": "91df8dfc-50a3-4a2c-ac88-11b2c23d43da",
        "name": "Phobos",
        "slug": "phobos"
      },
      {
        "id": "bdec6ece-3838-4f4d-a58f-fea2b5989241",
        "name": "CoinMiner",
        "slug": "coinminer"
      }
    ],
    "attack_patterns": [
      {
        "id": "5fbd38af-69a3-49b9-9ff4-e7ab3e59bd12",
        "name": "T1534"
      },
      {
        "id": "a2ba5594-6293-4868-928c-ab4b31927a02",
        "name": "T1572"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://asec.ahnlab.com/en/66372/",
    "https://otx.alienvault.com/pulse/666163affcce4a1ff5cae35a"
  ]
}