Threats Tagged 'relay network'

An Iranian threat actor's operational infrastructure was exposed through an open directory, revealing a 15-node relay network spanning Finland and Iran, an SSH-based botnet framework, and an active command and control server. The exposed bash history documented the full operation, including tunnel deployment, DDoS tooling development, and botnet creation. The actor used on-host compilation to evade detection and leveraged a Python script for mass SSH deployment. The botnet client, compiled and renamed 'hex' on infected hosts, showed automatic reconnection capabilities. This operation appears to be financially or personally motivated rather than state-directed, with infrastructure dual-purposed for censorship bypass and attack operations.

MediumMalwareIranFinlandUnited States+6#ssh#open directory#mhddos

Ink Dragon, a Chinese threat actor, is conducting a sophisticated espionage campaign targeting government entities in Europe, Southeast Asia, and South America. The group exploits IIS misconfigurations to gain initial access and deploys a custom ShadowPad IIS Listener module to create a victim-based relay network, turning compromised servers into nodes of a distributed mesh. They use a new variant of the FinalDraft malware and platform-native tools to maintain stealth and blend into normal enterprise telemetry. Their operations are characterized by disciplined playbooks and advanced software engineering, enabling persistent and covert intrusions. The campaign poses a medium severity threat due to its targeted nature and stealth capabilities, with no known public exploits yet. European organizations, especially government sectors running IIS servers with potential misconfigurations, are at risk. The threat actor’s relay network complicates detection and response efforts, increasing the potential impact on confidentiality and operational integrity. Mitigation requires focused IIS hardening, network segmentation, and advanced telemetry analysis to detect anomalous relay behaviors.

MediumCampaignGermanyFranceItaly+7#espionage#government targets#relay network