Troop 61786 has resurfaced, with activity emanating from the 106.38.113.0/24 and 106.120.218.0/24 source ranges as they attempt to conceal their identities. Alongside these known ranges, there has been a recent surge in activity from new IP addresses, specifically 124.64.23.2 and 221.216.117.22, which have been observed communicating with ASN 749.
These actors are actively scanning and probing for vulnerabilities using their standard ports—80, 443, and 0 (ICMP)—while also utilizing more unusual ports such as 7000 and 8567. Their targeting remains focused on the defence, telecommunications, and technology sectors, but the scope of their operations also includes education and government organizations.
No comments:
Post a Comment