Hello and welcome to the Friday, October 10th, 2025 edition of the Sands in its Storms.

Stormcast, my name is Johannes Ulrich, recording today from Denver, Colorado.

And this episode is brought you by the sands.edu credit certificate program in Purple Team Operations.

And in diaries today, we do have another diary by one of our undergraduate interns.

This time it's Yin Guan Lo, who wrote about a redtail infection.

Redtail is a crafter jackacker, so essentially infecting your system in order to mine cryptocurrency,

in this case typically Monero.

Now, what I like about this particular write-up is it doesn't just focus on exactly what hash, for example, was used or what IP adders the attack

came from. Quite often defenders are a little bit overly concerned with these indicators of

compromise. What's really more important to inform your defense is the TTPs that are being used

by a particular attacker in order to

identify certain weaknesses in your systems that you need to defend. In this example, for example,

is things like weak passwords or, for example, the modification of the dot SSH authorized keys

file in order to gain persistent access to the system.

In particular, the later one is one of those things that's often not done very well.

So you want to protect that authorized keys file, maybe make sure that it's only

writable by the root user, or you deploy them centrally into a location other than

the user's home directory, which of course also then makes it easier to detect any unauthorized

modifications to this file. So overall, a nice approach here to look at a honeypot attack from this lens based on the

Mider Attack matrix and not just looking at these individual very kind of ephemeral

indicators of compromise.

Well, remember a week or two ago, I talked about the breach of the My Sonic Wall service.

...