In this blog post CyberCube claim:

CyberCube observed a malware infection on Colonial Pipeline’s network named “trojan.win32.razy.gen”

I'm really curious to know how this could be done from outside Colonial's network. I'm asking in general using this case as an example - please don't post any proprietary information


  • 1
    How do you know that the detection was external/remote?
    – schroeder
    Commented Jun 25, 2021 at 14:21
  • 1
    The blog post says so! The dections are labelled "external".
    – John C
    Commented Jun 28, 2021 at 13:01
  • The word "external" is not mentioned in the article at all. The discussions about the malware do not mention how it was detected.,
    – schroeder
    Commented Jun 28, 2021 at 14:04

1 Answer 1


The article doesn't say how that malware was detected, but from the other parts of the article, they used external traffic analysis to come to their other conclusions.

A search for trojan.win32.razy.gen shows that it is a malicious browser extension that redirects browser traffic in very specific ways.

So, from these clues, it would be reasonable to conclude that they could have seen this malware's traffic externally.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .