🔍 What
An attacker from 89.187.185.184 brute-forced SSH on host Clark (172.16.20.43), successfully authenticated as the analyst user after multiple failed attempts, and escalated privileges to root via sudo su. Following privilege escalation, the attacker ran user enumeration (getent passwd), base64-encoded the /etc/passwd file into /root/Documents/encoded.dat, and attempted to exfiltrate it via a curl POST to an external domain. No outbound firewall log was found to confirm whether the transfer succeeded, but the staged file was confirmed to contain /etc/passwd content.
🕐 When
Aug 07, 2024, 08:21 AM — Successful SSH login for analyst from 89.187.185.184 following failed brute-force attemptsAug 07, 2024, 08:26 AM — Alert triggered on suspicious Base64 encoding commandaudit(1723019072.835:8470) — getent passwd executed (user recon)audit(1723019219.904:8535) — curl exfil attempt executed📍 Where
172.16.20.4389.187.185.184http://ukr-net-files-loading-application.ru/upload/root/Documents/encoded.dat👤 Who
External attacker operating from 89.187.185.184, flagged on AbuseIPDB for repeated brute-force activity. The compromised account was analyst, which held sudo privileges. The attacker leveraged this to escalate to root.
❓ Why
The attacker brute-forced SSH access, used the analyst account’s sudo rights to reach root, encoded /etc/passwd to obfuscate exfiltrated content, and attempted to POST the file to an external server hosted on a .ru domain. The goal was likely credential harvesting — /etc/passwd exposes which accounts exist and have shell access, enabling follow-on attacks or lateral movement.
🎯 MITRE ATT&CK
| ID | Tactic | Technique |
|---|---|---|
| T1110.001 | Credential Access | Brute Force - Password Guessing |
| T1078 | Defense Evasion / Initial Access | Valid Accounts |
| T1033 | Discovery | System Owner/User Discovery |
| T1027 | Defense Evasion | Obfuscated Files or Information |
| T1548.003 | Privilege Escalation | Abuse Elevation Control Mechanism - Sudo and Sudo Caching |
| T1048.003 | Exfiltration | Exfiltration Over Unencrypted Non-C2 Protocol |
📋 IOCs
| Type | Value | Context |
|---|---|---|
| IP | 89.187.185.184 |
Attacker source IP — brute force, AbuseIPDB flagged |
| Domain | ukr-net-files-loading-application.ru |
Exfil destination domain |
| URL | http://ukr-net-files-loading-application.ru/upload |
Curl POST exfil target |
| File | /root/Documents/encoded.dat |
Base64-encoded /etc/passwd staged for exfiltration |
| Command | getent passwd |
User enumeration recon post-compromise |
🔬 Analysis Reports IPAbuseDB https://www.abuseipdb.com/check/89.187.185.184?page=5 🦠 VirusTotal https://www.virustotal.com/gui/url/c78d42195e5a114d333d70812fc29d36425921fbb27d794b20327fb9fcfff08b/details