{"id":8108,"date":"2025-03-04T12:36:29","date_gmt":"2025-03-04T12:36:29","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/4000-isp-ips-hit-by-brute-force-attacks\/"},"modified":"2025-03-04T12:36:30","modified_gmt":"2025-03-04T12:36:30","slug":"4000-isp-ips-hit-by-brute-force-attacks","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/4000-isp-ips-hit-by-brute-force-attacks\/","title":{"rendered":"4,000+ ISP IPs Hit by Brute-Force Attacks"},"content":{"rendered":"\n<\/p>\n

Article Information<\/h2>\n

\ue802<\/i>Mar 04, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Network Security \/ Ransomware<\/span><\/p>\n

Article Body<\/h2>\n
\nThe internet service providers (ISPs) in China and the West Coast of the United States have become the target of a large-scale exploitation campaign. This campaign involves the deployment of information stealers and cryptocurrency miners on compromised hosts. <\/p>\n

The findings, reported by the Splunk Threat Research Team, reveal that the malicious activity has led to the delivery of various binaries. These binaries facilitate data exfiltration and establish persistence on the compromised systems.<\/p>\n

The unidentified threat actors have performed “minimal intrusive operations to avoid detection, with the exception of artifacts created by accounts already compromised,” according to a technical report published by Cisco-owned Splunk.<\/p>\n

<\/a><\/center><\/div>\n

These threat actors primarily use tools that depend on scripting languages, such as Python and Powershell, allowing them to operate under restricted environments. They also utilize API calls, like Telegram, for command-and-control (C2) operations.<\/p>\n

The attacks have been observed to leverage brute-force attacks, exploiting weak credentials. These intrusion attempts originate from IP addresses associated with Eastern Europe, targeting over 4,000 IP addresses of ISP providers.<\/p>\n

Upon gaining initial access to the target environments, the attacks drop several executables via PowerShell. These executables conduct network scanning, information theft, and XMRig cryptocurrency mining by abusing the victim’s computational resources.<\/p>\n

Prior to the payload execution, there is a preparatory phase that involves turning off security product features and terminating services associated with cryptominer detection.<\/p>\n

\"\"<\/a><\/div>\n

The stealer malware can capture screenshots and functions as a clipper malware, designed to steal clipboard content by searching for wallet addresses of various cryptocurrencies, including Bitcoin (BTC), Ethereum (ETH), Binance Chain BEP2 (ETHBEP2), Litecoin (LTC), and TRON (TRX).<\/p>\n

The gathered information is then exfiltrated to a Telegram bot. Additionally, a binary is dropped onto the infected machine, which launches additional payloads, including:<\/p>\n

\"Cybersecurity\"<\/a><\/center><\/div>\n