131.226.2[.]6 IP Post exploitation C2
134.199.202[.]205 IP IP address exploiting SharePoint vulnerabilities
104.238.159[.]149 IP IP address exploiting SharePoint vulnerabilities
188.130.206[.]168 IP IP address exploiting SharePoint vulnerabilities
65.38.121[.]198 IP Post-exploitation C2 for Storm-2603
These vulnerabilities affect on-premises SharePoint servers only and do not affect SharePoint Online in Microsoft 365.
As of this writing, Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting these vulnerabilities targeting internet-facing SharePoint servers
Microsoft observed multiple threat actors conducting reconnaissance and attempting exploitation of on-premises SharePoint servers through a POST request to the ToolPane endpoint.
In observed attacks, threat actors send a crafted POST request to the SharePoint server, uploading a malicious script named spinstall0.aspx. Actors have also modified the file name in a variety of ways, such as spinstall.aspx, spinstall1.aspx, spinstall2.aspx, etc. The spinstall0.aspx script contains commands to retrieve MachineKey data and return the results to the user through a GET request, enabling the theft of the key material by threat actors
Since 2012, Linen Typhoon has focused on stealing intellectual property, primarily targeting organizations related to government, defense, strategic planning, and human rights.
Since 2015, the Violet Typhoon activity group has been dedicated to espionage, primarily targeting former government and military personnel, non-governmental organizations (NGOs), think tank
using Mimikatz, specifically targeting the Local Security Authority Subsystem Service (LSASS) memory to extract plaintext credentials. The actor moves laterally using PsExec and the Impacket toolkit, executing commands using Windows Management Instrumentation (WMI).
Storm-2603 is then observed modifying Group Policy Objects (GPO) to distribute Warlock ransomware in compromised environments.
Fast reverse proxy tool used to connect to C2 IP 65.38.121[.]198
131.226.2[.]6 IP Post exploitation C2
134.199.202[.]205 IP IP address exploiting SharePoint vulnerabilities
104.238.159[.]149 IP IP address exploiting SharePoint vulnerabilities
188.130.206[.]168 IP IP address exploiting SharePoint vulnerabilities
65.38.121[.]198 IP Post-exploitation C2 for Storm-2603
Nuclear Safety NNSA hacked article
ACTIVE DASHBOARD
DOGE Timeline
COOL PROJECTS
