From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/iocs/c2-paths.txt | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 kevlar/2026-08-31/iocs/c2-paths.txt (limited to 'kevlar/2026-08-31/iocs/c2-paths.txt') diff --git a/kevlar/2026-08-31/iocs/c2-paths.txt b/kevlar/2026-08-31/iocs/c2-paths.txt new file mode 100644 index 0000000..8503a7b --- /dev/null +++ b/kevlar/2026-08-31/iocs/c2-paths.txt @@ -0,0 +1,24 @@ +# Notable paths, 2026-08-24 to 2026-08-31 + +/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE swarm, 3 days, fleet-wide; NightAgent POST variant carries +/v2/_catalog -- Docker Registry catalog enumeration (registry-hunt campaign) +/v2/internal/api-gateway/tags/list -- internal registry enumeration (registry-hunt) +/v2/internal/api-gateway/manifests/latest -- internal registry enumeration (registry-hunt) +/v2/internal/auth-service/tags/list -- internal registry enumeration (registry-hunt) +/console/ -- WebLogic console login probe (registry-hunt journey step) +/login.action -- Confluence login probe (registry-hunt journey step) +/___proxy_subdomain_whm/login, /___proxy_subdomain_cpanel -- WHM/cPanel proxy-subdomain probes +/xmlrpc.php -- 8,146 POST brute in 31 minutes (34.63.40.186, GCP) +/wp-json/batch/v1 -- WordPress batch abuse; forged X-Forwarded-For: 127.0.0.1 on all requests; SQLi multiplex variant carries UNION SELECT with CONCAT(0x7c7c, HEX(...), 0x7c7c) +/fetch, /proxy -- SSRF proxy discovery (metadata-hunt campaign) +/.mcp.json -- MCP endpoint discovery probe +/@fs/etc/passwd, /@fs/proc/self/environ -- Vite dev-server traversal probes +/global-protect/login.esp -- Palo Alto GlobalProtect login brute (176.120.22.43) +/+CSCOE+/logon.html -- Cisco ASA clientless VPN login probe (176.120.22.43) +/api/checkin -- beacon checkin (FLOKINET 185.100.87.136) +/eventmanager -- beacon poll (FLOKINET 185.100.87.136) +/api/client/update?arch=amd64&commit=08059e95dacaf -- beacon update pull (FLOKINET 185.100.87.136) +/v1/getinfo -- high-port agent info request (AEZA 147.45.71.214) +http://azenv.net/ -- proxy validation target (PFCLOUD 204.76.203.7) +/1.bat, /0x83911d24Fx.sh, /.tygahhh/ENCRYPTED.ps1 -- malware dropper dictionary samples (169.150.201.29) +/.env, /.aws/credentials, /.azure/credentials, /tfstate, /firebase.json -- credential harvest sweep paths (CREDSWEEP) -- cgit v1.2.3