144.202.61[.]209IP address
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 13 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“Immediately after, the threat actors initiated outbound network traffic to the IP address 144.202.61[.]209 using WinsCP via File Transfer Protocol (FTP), efficiently exfiltrating the staged files for approximately 15 minutes.”
Indicators reported together
named in the same reports- delete[.]mein 1 report
- hxxps://cwe.mitre[.]org/data/definitions/427.htmlin 1 report
- 45.141.87[.]55in 1 report
- 149.28.101[.]219in 1 report
- 504e1c95.host.njalla[.]netin 1 report
- 504ec1c95.host.njalla[.]netin 1 report
- 80.78.28[.]149in 1 report
- 71f703024c3d3bfc409f66bb61f971a0in 1 report
- f24fc14f39c160b5…a605ec0eb04fin 1 report
- bcff246f0739ed98…5c3f050c7805in 1 report
- e963d598a86c5ee428a2eefa34d1ffbbin 1 report
- 142294249feb536e…b3c3415ecf39in 1 report
- 6f9326224e604745…bfbc916c4b33in 1 report
- 5675a7773f6d3224bfefdc01745f8411in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.