mirror of
https://github.com/activecm/rita
synced 2026-06-08 13:02:45 +00:00
Naomi KramerAll interesting traffic is coming from 73.54.23.243 to 64.225.56.201 The zeek sensor was running on 64.225.56.201 The logs contain the following data: 3 days worth of log files An SSH session that is open the entire time An HTTP connection with a blank "Host:" parameter It has a unique user agent string of "'Modzilla/0.0001 (Atari 7800)'" HTTP connection is beaconing every 200-350 seconds