Hello, welcome to the Tuesday, August 25th, 2020 edition of the Sands and its Storm Center's

Stormcast. My name is Johannes Ulrich. And then I'm recording from Jacksonville, Florida.

Today in Diaries, we got a quick walkthrough from Xavier on how to track Malware through Virus Total. One of the nice things, of course,

with a large database of Malware like Virus Total is that you can look for similar pieces of

malware than the one that you may have detected in your environment. Now, some of the features

discussed here do require a paid subscription to Virus total, but it can be quite valuable to actually figure out that, for example, a piece of malware has been detected by others as well, or that variations of this malware have already been seen in the past, which often allows you to

sort of combine different threat actors or threats to one particular threat actor.

And today, many school districts, at least in the United States, did start their academic

year again, and with that, of course,

much of this happened online and it put some strain on calmly used online services. Zoom, for

example, had some outages. There's also some talk about some issues with Microsoft Office 365. Not sure if that was related to the opening of the school year, but also some education-specific services like learning management systems and such, in part, had a hard time coping with the large number of users,

of course, working from home and starting school online.

By the afternoon Eastern time, most of this looked like it was resolved.

We'll have to see throughout the week if there are any repeat issues like that, probably best to be ready

and have a backup plan. And yesterday I mentioned how a Guy wrote a diary of RDP servers being

hunted even on off ports like Port 23. We have more and more evidence that really RDP servers

are the low-hanging fruit that all kinds of attackers

are going after a little bit late to the game maybe is apparently Iran.

At least group IB is fingering Iran as one group that's going after RDP servers.

The attack is pretty much always the same, no matter who does it.

And of course, attribution always take it with a large crane of salt.

But it comes down to password brute forcing, usually, credential stuffing,

...