Recent content by Redempshin

Yeah, I got that vibe, I haven't been here in years and hadn't realized it had gotten so bad.

So....the blog post discusses that its actually very quiet because the bad guy is building an army and waiting. Traffic/open sessions isn't the issue. Scan the interface and see if that port is open.

Come on.... That's just painfully wrong. They attackers turned on SSH on a specific port, created an additional login and turned off security functions. Those are all VERY detectable. The ACTUAL information from GreyNoise says You could say "the attackers took steps to try and avoid...