_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary], (Tue, Jul 7th)
ID: 833dda86-6e26-5608-aa52-e6011f683742
STIX ID: report--833dda86-6e26-5608-aa52-e6011f683742
Feed Name: SANS ISC Diary
Threat Score
A SANS/ISC honeypot observed a globally-distributed scanning bot that sends an unusual help-message URI and performs SSH brute-force attempts using common default credentials; the bot's author claims it is a non-persistent, autonomous "performance" scanner from Belarus but analysts should treat it as an untrusted credential-guessing scanner and remediate exposed SSH services.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.