Hello and welcome to the Friday, July 11, 2025 edition of the Sands and then at Storm Center's

Stormcast. My name is Johannes Orich, and today's episode, which is brought to you by the Sands.

edu Graduate Certificate Program in Penetration Testing and Ethical Hacking is recorded in Jacksonville, Florida.

In Diaries today, we have yet again one of our undercreated interns with the Sands.edu Bax program.

Write up an observation from a honeypot.

This particular one comes from Cui Neo, and it does show how attackers are using, well, open SSH servers.

In this case, weak passwords are typically used in order to penetrate the SH server, but the attacker

here is actually kind of leaving the SSH server alone. It's only using the SH server to then

set up SH tunnels to other systems. And in this

particular case, one of the top targets that attackers were after was a mail server with

Yandex, Yandex being a large Russian ISP, which also operates a very large webmail system.

So they're probably going to send some kind of spam to this particular mail server.

This is a rather common technique to use a compromised S-H server as a proxy essentially to forward requests that obfuscates the actual source

of the attack. Sometimes they can also be sort of daisy chain, where you have multiple proxies

like this in order to further obfuscate the actual source of the attack. In the past,

even nation-state actors have sometimes

used this technique via compromised home systems, home routers, and the like in order to again

obfuscate their track and yet another reason why usually country blocks and the like

are not really helping against any of the little bit more

sophisticated attackers. And then before I forget it again, I intended to cover this

yesterday already, but well, it didn't quite make it. FortyGuard released an advisory

alerting its users of a critical vulnerability in the 40 web application.

...