#QuicksandModule

@infosec_jcp 🐈🃏 done differentlyinfosec_jcp@infosec.exchange
2024-06-11

Huh. _TWO_ badbunny hosts with the #SystemApp #GammaGroup #FinFisher #FinSpy #Finsky callback to client but ... This time the scanned host comes up with interesting results after being caught. Both back to back attack attempts.

One host was scanned about a year ago and the other, another attack node quite frequently used, was scanned less than a month ago.

#Datapacket.Com #BunnyNet #InfosecExchange #infosec #fediverse #fediadmin

Typical attack pattern. After detection an attempt of using the #QuicksandModule was sent to client, tried crashing client. SystemUI crash attempt, etc.

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst