As part of a course I'm doing, it's presented a case study. I'm a bit stuck and not too sure where to find further info. If someone could point me in the direction, I'd appreciate it.

In this case study, a network using Red Hat Linux mail and file servers, a proprietary SIEM server and several Windows 2012 servers have come under possible attack. It's noted that:

  • VMProtectss & NetCat were installed
  • There was some streaming traffic to a URL with the ending port 9091
  • Ports 9091 & 9092 were opened, and a single packet was sent to a url ending in 9092
  • The Linux servers were not recently updated and did not have end point injection
  • No data modification occurred

From what I can gather so far, VMProtectss is a windows-based cryptominer and NetCat could be a C2 element that establishes a connection over tcp/udp. I think that the single packet to 9092 was a confirmation that NetCat was installed and opens the connection for extended intrusion. I don't know what the streaming traffic to 9091 could be.

The questions they're asking are:

  • What was possibly happening to the Linux servers
  • What was the impact to the network and was there a data breach
  • what methods would be taken to remove malicious code

I'm not expecting anyone to answer these questions for me, more about where I can go to find further information.

  • The problem is that Stack Exchange isn't the right place for this. Questions are supposed to be clearly answerable, and your question is way too broad. – MechMK1 Nov 11 '19 at 9:32
  • Most courses prohibit students from seeking outside help with their assignments. You should speak to your professor or TA. – DoubleD Nov 12 '19 at 23:02