Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity

In early November, we came across an open directory that included more than a year of historical threat actor activity. By analyzing tools, logs and artifacts left open to the internet, we were able to profile the threat actor and their victims



https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/

actor analysis artifacts cybersecurity directory internet logs november persistent profile threat threat actor tools