Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Uncovering GoPhish Deployments
Excerpt
Nothing special this weekend, just a short writeup on quick and easy ways of finding GoPhish instances. GoPhish GoPhish is an open-source phishing simulation framework used by organizations to test and train their employees cybersecurity awareness and by threat actors to test if they can phish unsuspecting users. Using templates, an HTML editor and an easy to use UI, it makes it easy to create phishing campaigns. Upon installation it uses port 3333 by default for its…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 2.59.22.50 | High | Score 58/100 | First seen |
| IP | 3.212.215.46 | High | Score 58/100 | First seen |
| Domain | admin.0kta.help | High | Score 58/100 | First seen |
| URL | https://2.59.22.50:3333 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…