Hi @MBuratowski: I'm trying to find details on iii—can you be more specific on those common C2 IPs? @pwnallthethingshttps://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/ …
.@pwnallthethings Remarkably the same C2 IP actually is hardcoded in the DNC and BUNDESTAG APT28 samples.pic.twitter.com/xhTlHOtUpz
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
.
@pwnallthethings This SSL certificate seems to be another link between DNC & BUNDESTAG cases; see rel host details https://www.threatminer.org/ssl.php?q=a1833c32d5f61d6ef9d1bb0133585112069d770e …Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
#DNCleak#DNCinPHL@RidT@pwnallthethings IP address is in France, those damn frogs!
http://www.ipaddress-finder.com/?ip=176.31.112.10 …Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Could you clarify how/where you found those hardcoded IPs? Did you examine the binaries themselves or...?
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Those servers were dead at the time, so at best these would be leftover artifacts, not in-use infrastructurehttps://mobile.twitter.com/outsh1ned/status/934202496049823744 …
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.