INFOSTEALER CAMPAIGN AGAINST ISPS

Summary from the TLDR InfoSec newsletter

The Splunk Threat Research Team identified a new campaign targeting ISP infrastructure. Attackers use weak credentials to gain initial access, downloading malware from a C2 server that runs a crypto miner and an infostealer to detect crypto wallet passphrases and take screenshots. They establish persistence and pivot to additional IP CIDRs, utilizing Python and Powershell scripts to maintain a minimal presence, including IoCs in the post.