Stories from the SOC - RapperBot, Mirai Botnet - C2, CDIR Drop over SSH

Stories from the SOC is a blog series that describes recent real-world security incident investigations conducted and reported by the AT&T SOC analyst team for AT&T Managed Extended Detection and Response customers. 

Executive summary

Since mid-June 2022, AT&T Managed Extended Detection and Response (MXDR) Security Operations Center (SOC) observed an enormous number of attacks from Mirai botnet-C2 attempting to gain access to SSH servers instead of Telnet.

Due to the various tactics, techniques, and procedures (TTP) observed, this attack has …

access amp analyst attacks blog botnet center customers detection detection and response executive extended detection extended detection and response incident investigations june managed managed extended detection and response mirai mirai botnet operations rapperbot response security security incident security operations security operations center series servers soc soc analyst ssh stories team world