Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)
ID: 55a9c724-6cbd-5a31-a83f-4aa28e2dcf52
STIX ID: report--55a9c724-6cbd-5a31-a83f-4aa28e2dcf52
Feed Name: SANS ISC Diary
Threat Score
SANS reports active brute-force attempts against CrushFTP servers where attackers post requests with username=crushadmin and password=crushadmin in the URL query (empty POST body), targeting lazily configured admin accounts; traffic is observed from IP 5.189.139.225 and this activity is opportunistic rather than exploiting a specific zero-day.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.