A week after Dutch FIOD seized 800+ servers, the hosting network’s ASN (AS209847) is still scanning at its normal daily rate

After FIOD seized 800+ servers and arrested two operators on May 18, the ELLIO research team reports that scanning from the network’s ASN ranges has continued largely uninterrupted – and that while roughly a third of the recently-active ranges (including the legacy Stark blocks 94.131.105.0/24 and 92.118.232.0/24) have since been withdrawn from global routing, the surviving ranges under AS209847 (WorkTitans / THE.Hosting) are still announced and still scanning, at the network’s normal daily rate. The sibling ASNs (AS213999 and the Moscow-based AS33993) remain routed and idle. The recent activity skews toward database and ICS/SCADA discovery = MongoDB, Redis, PostgreSQL, Oracle, LDAP, plus DNP3 and EtherNet/IP – alongside known-exploit probes like CVE-2017-17215 and WinRM. submitted by /u/HexLayer3 [link] [comments]Technical Information Security Content & DiscussionRead More