As part of a course I'm doing, it's presented a case study. I'm a bit stuck and not too sure where to find further info. If someone could point me in the direction, I'd appreciate it.
In this case study, a network using Red Hat Linux mail and file servers, a proprietary SIEM server and several Windows 2012 servers have come under possible attack. It's noted that:
- VMProtectss & NetCat were installed
- There was some streaming traffic to a URL with the ending port 9091
- Ports 9091 & 9092 were opened, and a single packet was sent to a url ending in 9092
- The Linux servers were not recently updated and did not have end point injection
- No data modification occurred
From what I can gather so far, VMProtectss is a windows-based cryptominer and NetCat could be a C2 element that establishes a connection over tcp/udp. I think that the single packet to 9092 was a confirmation that NetCat was installed and opens the connection for extended intrusion. I don't know what the streaming traffic to 9091 could be.
The questions they're asking are:
- What was possibly happening to the Linux servers
- What was the impact to the network and was there a data breach
- what methods would be taken to remove malicious code
I'm not expecting anyone to answer these questions for me, more about where I can go to find further information.