idk why, but the performance of #AzireVPN, especially its stability, has decreased significantly (reddit users would say "since the acquisition by #Malwarebytes / #FiveEyes" ). There are non-stop disconnects, and even when the connection is up, the overall throughput and RTT are laughable.

back to #Mullvad it is and... wow, 50% lower median RTT ๐Ÿคก

the actually sad part is that everybody hosts at #Datapacket, #31173, #xtom, and #M247, which comfortably covers #FourteenEyes

mhmm.. probably nobody remembers or even knows about #ovpnTO (not to be confused with #ovpnCOM) #MrNice #timeflies

ps: please ignore the packet loss, as the step size is 5min and I just reconfigured and restarted everything - thx

#vpn #opnsense #smokeping #homelab

@stevenrosenthal @KamalaHarrisWin

Old Man yells at #DataPacket โ˜๏ธ.

#GammaGroup #FinFisher #FinSpy #SystemApp callback caught #CALEA #malware #GreyMarket #investigations

๐Ÿ’ป๐Ÿคโ˜ฃ๏ธ๐Ÿค๐Ÿคณ ๐ŸŽฃ๐Ÿ”๐Ÿง

on #BunnyNet's CDN from #DataPacket

Interesting vectors... Quite the pointers this scan. Was scanned last 1yr ago. Showed up as malicious. Scans clean now except for the #malware found as a #GammaGroup shim caught nao. ๐ŸŽฃ

Caught a bit o' Meta also in the callback graph. Huh.

#VirusTotal
https://www.virustotal.com/graph/embed/g7ee0dd48fe8e4dbbaf440955ee7bfbf57af12ca1c14543e08671f514fafb75be

Virustotal Graph

Virustotal Graph

@infosec_jcp ๐Ÿˆ๐Ÿƒ done differently (@[email protected])

Attached: 3 images ยท Content warning: #GammaGroup #FinFisher #FinSpy #SystemApp callback list of hosts / shims on #BunnyNet via #DataPacket

Infosec Exchange

Historical list of #SystemApp callback to #FinFisher clients logged while on #InfoseceXchange that's good for #tcpdump correlation #investigations in #Germany on the CDN #DataPacket hosting the #BunnyNet since November 2022ish for #GermanProsecutors to correlate.

#FinFisherCom๐Ÿค#EnemyOfTheInternet

#CALEA #greymarket #CALEAmalware ๐Ÿ”๐Ÿง#infosec

ยน
143-244-49-183.bunnyinfra.net

ยฒ
143-244-50-83.bunnyinfra.net

ยณ
169.150.221.147

โด
143-244-50-88.bunnyinfra.net

โต
143-244-50-211.bunnyinfra.net

โถ
169-150-249-163.bunnyinfra.net

โท
169-150-221-147.bunnyinfra.net

โธ
143-244-50-82.bunnyinfra.net

โน
143-244-50-213.bunnyinfra.net

ยนโฐ
143-244-50-209.bunnyinfra.net

ยนยน
143-244-49-180.bunnyinfra.net

ยนยฒ
143.244.50.214

ยนยณ
185-93-1-251.bunnyinfra.net

ยนโด
unn-169-150-249-163.datapacket.com

ยนโต
unn-169-150-249-165.datapacket.com

ยนโถ
unn-169-150-249-164.datapacket.com

ยนโท
unn-169-150-249-166.datapacket.com

Cities:
ยน
https://www.reddit.com/r/netzpolitik/comments/jax0e3/our_criminal_complaint_german_statemalware/

ยฒ
https://en.wikipedia.org/wiki/FinFisher

ยณ
https://www.spiegel.de/netzwelt/netzpolitik/finfisher-ueberwachungssoftware-hersteller-ist-insolvent-a-399e29e2-a7ae-4966-8d26-fc3c4f92db64

โด
https://netzpolitik.org/2022/nach-pfaendung-staatstrojaner-hersteller-finfisher-ist-geschlossen-und-bleibt-es-auch/

โต
https://www.securityweek.com/german-authorities-seize-spyware-firm-finfishers-accounts/

โถ
https://www.bloomberg.com/news/articles/2022-03-28/spyware-vendor-finfisher-claims-insolvency-amid-investigation

#RTDNA #StateSponsoredMalwareโ„ข #SSMโ„ข #malware

New #BunnyNet #GammaGroup #FinFisher #FinSpy #Finsky shim for #SystemApp found. #StateSponsoredMalwareโ„ขโœ“

This host hasn't been scanned in over 1yr until today.

Initially scanned and found nothing. Dug in a bit further and found some interesting vectors for wot compromised #DataPacket's #BunnyCDN #BunnyNet though #blueteam at #DataPacket โš ๏ธ๐Ÿ‘‰โ˜ฃ๏ธ

#VirusTotal
https://www.virustotal.com/graph/embed/gdb48e1efd4a845b9951dcef691fdf3a2f8c56309a9ef445b8f0b7767a351a0e4

Virustotal Graph

Virustotal Graph

Huh. _TWO_ badbunny hosts with the #SystemApp #GammaGroup #FinFisher #FinSpy #Finsky callback to client but ... This time the scanned host comes up with interesting results after being caught. Both back to back attack attempts.

One host was scanned about a year ago and the other, another attack node quite frequently used, was scanned less than a month ago.

#Datapacket.Com #BunnyNet #InfosecExchange #infosec #fediverse #fediadmin

Typical attack pattern. After detection an attempt of using the #QuicksandModule was sent to client, tried crashing client. SystemUI crash attempt, etc.

๐Ÿ”Žโ˜ฃ๏ธ The amount of exploited #BunnyNet hosts on #DataPacket has increased which hosts a lot of the #fediverse. #Germany โ˜ฃ๏ธ๐Ÿ”

#GammaGroup #FinFisher #fediverse #FinSpy #Finsky #CALEA #GreyMarket #investigations #infosec

Damn, #BunnyNet, hopping AND a blocking someone! ๐Ÿ‘€๐Ÿ‘€๐Ÿ‘€๐Ÿ”ฅ๐Ÿ˜† #infosec #FinFisher #FinSpy #SSMโ„ข #GreyMarket #investigations #Germany #DataPacket๐Ÿ”ฌ๐Ÿ‘€

Lots to unpack collections wise here
๐Ÿ”ฌ๐Ÿ‘€
โ˜ฃ๏ธ
๐Ÿ‘‡

https://www.virustotal.com/graph/embed/g453ee436acbc4884b8061f79b523a4aa57ec66436b2c454681836199b17063ec

Virustotal Graph

Virustotal Graph

#datapacket host breached #System call logged โ˜ฃ๏ธ๐Ÿฐโ˜ฃ๏ธ๐Ÿฐโ˜ฃ๏ธ๐Ÿ‡โ˜ฃ๏ธ

FQDN: 143-244-49-180.bunnyinfra.net

@jerry - let your upstream data hosting provider, bunny.net, know.

Following up.... Ahh.. a reported compromised host from 11 months ago... ๐Ÿ‡โ˜ฃ๏ธ๐Ÿฐโ˜ฃ๏ธ๐Ÿ‡โ˜ฃ๏ธ๐Ÿฐโ˜ฃ๏ธ

Still compromised by #GammaGroup btw

#VirusTotal
https://www.virustotal.com/graph/embed/g3e1e230061f04448956657b84c7538cdfb1d21b6e7b34a76a6e31f8656710583

Virustotal Graph

Virustotal Graph