Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-3120 | Remote Code Execution via Dynamic Scripting in Elasticsearch (CVE-2014-3120) | — | 89% | KEV | — KEV |
| CVE-2015-1427 | Sandbox Bypass RCE in Elasticsearch Groovy Scripting Engine | — | 100% | KEV | — KEV |
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server | 7.5 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2018-1273 | Unauthenticated RCE in VMware Tanzu Spring Data Commons | 9.8 | 97% | KEVRansomware | KEV |
| CVE-2018-7600 | Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 101.200.48.68 | rporate network. IOCS: First Actor: Attacking IP addresses: 101[.]200[.]48[.]68 117[.]205[.]7[.]194 107[.]182[.]183[.]206 124[.]43[.] |
| ipv4 | 104.203.170.198 | 84 125[.]77[.]30[.]184 IP address and port hosting malware: 104[.]203[.]170[.]198:5522 SHA256 of malware hosted on above IP address: 7f |
| ipv4 | 107.182.183.206 | cking IP addresses: 101[.]200[.]48[.]68 117[.]205[.]7[.]194 107[.]182[.]183[.]206 124[.]43[.]19[.]159 139[.]99[.]131[.]57 179[.]50[.]19 |
| ipv4 | 111.19.78.4 | 849bc9cf08259ba6a Remaining actors: Attacking IP addresses: 111[.]19[.]78[.]4 15[.]231[.]235[.]194 221[.]203[.]81[.]226 111[.]73[.] |
| ipv4 | 111.73.45.90 | 111[.]19[.]78[.]4 15[.]231[.]235[.]194 221[.]203[.]81[.]226 111[.]73[.]45[.]90 121[.]207[.]227[.]84 125[.]77[.]30[.]184 |
| ipv4 | 117.205.7.194 | S: First Actor: Attacking IP addresses: 101[.]200[.]48[.]68 117[.]205[.]7[.]194 107[.]182[.]183[.]206 124[.]43[.]19[.]159 139[.]99[.] |
| ipv4 | 121.207.227.84 | addresses linked to QQ account, but not delivering malware: 121[.]207[.]227[.]84 125[.]77[.]30[.]184 IP address and port hosting malwa |
| ipv4 | 124.43.19.159 | 1[.]200[.]48[.]68 117[.]205[.]7[.]194 107[.]182[.]183[.]206 124[.]43[.]19[.]159 139[.]99[.]131[.]57 179[.]50[.]196[.]228 185[.]165[.] |
| ipv4 | 125.231.139.75 | 5bc1040757d6baec3f8415 Third Actor: Attacking IP addresses: 125[.]231[.]139[.]75 36[.]235[.]171[.]244 IP addresses linked to QQ accoun |
| ipv4 | 125.77.30.184 | Q account, but not delivering malware: 121[.]207[.]227[.]84 125[.]77[.]30[.]184 IP address and port hosting malware: 104[.]203[.]170[ |
| ipv4 | 139.159.218.82 | 96 45[.]76[.]178[.]34 52[.]8[.]60[.]118 54[.]70[.]161[.]251 139[.]159[.]218[.]82 IP addresses and ports hosting malware: 45[.]76[.]122 |
| ipv4 | 139.99.131.57 | 7[.]205[.]7[.]194 107[.]182[.]183[.]206 124[.]43[.]19[.]159 139[.]99[.]131[.]57 179[.]50[.]196[.]228 185[.]165[.]116[.]144 189[.]201[ |
| ipv4 | 15.231.235.194 | Remaining actors: Attacking IP addresses: 111[.]19[.]78[.]4 15[.]231[.]235[.]194 221[.]203[.]81[.]226 111[.]73[.]45[.]90 121[.]207[.]2 |
| ipv4 | 179.50.196.228 | 7[.]182[.]183[.]206 124[.]43[.]19[.]159 139[.]99[.]131[.]57 179[.]50[.]196[.]228 185[.]165[.]116[.]144 189[.]201[.]192[.]242 191[.]189 |
| ipv4 | 185.165.116.144 | 24[.]43[.]19[.]159 139[.]99[.]131[.]57 179[.]50[.]196[.]228 185[.]165[.]116[.]144 189[.]201[.]192[.]242 191[.]189[.]30[.]112 192[.]210[ |
| ipv4 | 189.201.192.242 | [.]99[.]131[.]57 179[.]50[.]196[.]228 185[.]165[.]116[.]144 189[.]201[.]192[.]242 191[.]189[.]30[.]112 192[.]210[.]198[.]50 195[.]201[. |
| ipv4 | 191.189.30.112 | ]50[.]196[.]228 185[.]165[.]116[.]144 189[.]201[.]192[.]242 191[.]189[.]30[.]112 192[.]210[.]198[.]50 195[.]201[.]169[.]194 216[.]15[. |
| ipv4 | 192.210.198.50 | ]165[.]116[.]144 189[.]201[.]192[.]242 191[.]189[.]30[.]112 192[.]210[.]198[.]50 195[.]201[.]169[.]194 216[.]15[.]146[.]34 43[.]240[.] |
| ipv4 | 195.201.169.194 | .]201[.]192[.]242 191[.]189[.]30[.]112 192[.]210[.]198[.]50 195[.]201[.]169[.]194 216[.]15[.]146[.]34 43[.]240[.]65[.]121 45[.]76[.]136 |
| ipv4 | 202.109.143.110 | fddbafa105fa3b1b507baa3 Second Actor: Attacking IP address: 202[.]109[.]143[.]110 IP address and port hosting malware: 216[.]176[.]179[ |
| ipv4 | 207.148.70.143 | ddresses and ports hosting malware: 45[.]76[.]122[.]92:8506 207[.]148[.]70[.]143:8506 SHA256 of delivered malware: bbd6839074adea73421 |
| ipv4 | 216.15.146.34 | .]189[.]30[.]112 192[.]210[.]198[.]50 195[.]201[.]169[.]194 216[.]15[.]146[.]34 43[.]240[.]65[.]121 45[.]76[.]136[.]196 45[.]76[.]178 |
| ipv4 | 216.176.179.106 | 202[.]109[.]143[.]110 IP address and port hosting malware: 216[.]176[.]179[.]106:9090 SHA256 of delivered malware: bbd6839074adea73421 |
| ipv4 | 221.203.81.226 | acking IP addresses: 111[.]19[.]78[.]4 15[.]231[.]235[.]194 221[.]203[.]81[.]226 111[.]73[.]45[.]90 121[.]207[.]227[.]84 125[.]77[.]30 |
| ipv4 | 36.235.171.244 | 5 Third Actor: Attacking IP addresses: 125[.]231[.]139[.]75 36[.]235[.]171[.]244 IP addresses linked to QQ account, but not delivering |
| ipv4 | 43.240.65.121 | [.]210[.]198[.]50 195[.]201[.]169[.]194 216[.]15[.]146[.]34 43[.]240[.]65[.]121 45[.]76[.]136[.]196 45[.]76[.]178[.]34 52[.]8[.]60[.] |
| ipv4 | 45.76.122.92 | 39[.]159[.]218[.]82 IP addresses and ports hosting malware: 45[.]76[.]122[.]92:8506 207[.]148[.]70[.]143:8506 SHA256 of delivered ma |
| ipv4 | 45.76.136.196 | 5[.]201[.]169[.]194 216[.]15[.]146[.]34 43[.]240[.]65[.]121 45[.]76[.]136[.]196 45[.]76[.]178[.]34 52[.]8[.]60[.]118 54[.]70[.]161[.] |
| ipv4 | 45.76.178.34 | 216[.]15[.]146[.]34 43[.]240[.]65[.]121 45[.]76[.]136[.]196 45[.]76[.]178[.]34 52[.]8[.]60[.]118 54[.]70[.]161[.]251 139[.]159[.]218 |
| ipv4 | 52.8.60.118 | 43[.]240[.]65[.]121 45[.]76[.]136[.]196 45[.]76[.]178[.]34 52[.]8[.]60[.]118 54[.]70[.]161[.]251 139[.]159[.]218[.]82 IP addresses |
| ipv4 | 54.70.161.251 | 21 45[.]76[.]136[.]196 45[.]76[.]178[.]34 52[.]8[.]60[.]118 54[.]70[.]161[.]251 139[.]159[.]218[.]82 IP addresses and ports hosting m |
| sha256 | 191f1126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da7002a8c | e608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfdc00dc 191f1126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da7002a8c 2bcc9fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170 |
| sha256 | 2bcc9fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170dc123 | 126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da7002a8c 2bcc9fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170dc123 9a181c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d |
| sha256 | 5fe3b0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c83b90 | c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d5448c 5fe3b0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c83b90 7b08a8dae39049aecedd9679301805583a77a4271fddbafa105fa3b1b50 |
| sha256 | 709d04dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c306618e | f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6571ba 709d04dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c306618e 830db6a2a6782812848f43a4e1229847d92a592671879ff849bc9cf0825 |
| sha256 | 7b08a8dae39049aecedd9679301805583a77a4271fddbafa105fa3b1b507baa3 | 0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c83b90 7b08a8dae39049aecedd9679301805583a77a4271fddbafa105fa3b1b507baa3 Second Actor: Attacking IP address: 202[.]109[.]143[.]110 I |
| sha256 | 7f18c8beb8e37ce41de1619b2d67eb600ace062e23ac5a5d9a9b2b3dfaccf79b | 70[.]198:5522 SHA256 of malware hosted on above IP address: 7f18c8beb8e37ce41de1619b2d67eb600ace062e23ac5a5d9a9b2b3dfaccf79b dac92c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d7 |
| sha256 | 830db6a2a6782812848f43a4e1229847d92a592671879ff849bc9cf08259ba6a | 4dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c306618e 830db6a2a6782812848f43a4e1229847d92a592671879ff849bc9cf08259ba6a Remaining actors: Attacking IP addresses: 111[.]19[.]78[.]4 |
| sha256 | 9a181c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d5448c | fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170dc123 9a181c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d5448c 5fe3b0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c |
| sha256 | bbd6839074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415 | 8506 207[.]148[.]70[.]143:8506 SHA256 of delivered malware: bbd6839074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415 e2f1be608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfd |
| sha256 | d3447f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6571ba | 653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6437fc d3447f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6571ba 709d04dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c30 |
| sha256 | dac92c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d700500 | 8beb8e37ce41de1619b2d67eb600ace062e23ac5a5d9a9b2b3dfaccf79b dac92c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d700500 e5a04653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6 |
| sha256 | e2f1be608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfdc00dc | 39074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415 e2f1be608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfdc00dc 191f1126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da70 |
| sha256 | e5a04653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6437fc | c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d700500 e5a04653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6437fc d3447f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6 |
From the original article
6 min read at blog.talosintelligence.com
Christopher Evans of Cisco Talos conducted the research for this post. Cisco Talos warns users that they need to keep a close eye on unsecured Elasticsearch clusters. We have recently observed a spike in attacks from multiple threat actors targeting these clusters.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.