149.28.106[.]252IP address
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Patch or Peril: A Veeam vulnerability incident“…rmant account identified as ‘Acc1.’ Several days later, a successful VPN login using ‘Acc1’ was traced back to the remote IP address 149.28.106[.]252”
Indicators reported together
named in the same reports- 149.28.99[.]61in 1 report
- 45.76.232[.]205in 1 report
- 77.238.245[.]11in 1 report
- hxxp://www.joeware[.]net/freetools/tools/adfind/%E2%80%9Din 1 report
- www.joeware[.]netin 1 report
- cb704d2e8df80fd3…dc262d80ddb8in 1 report
- 2c56e9beea9f0801…9b4fa0661362in 1 report
- 5e460a517f0579b8…58ac0dd3d4fain 1 report
- 107ec3a7ed7ad908…d4b999d4690cin 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2023-27532
Thanks — we review every report.