Eric.freyssinet: Text replacement - " www.securelist.com" to ""

2015-02-07T17:02:03Z

Text replacement - " www.securelist.com" to ""

← Older revision		Revision as of 17:02, 7 February 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.securelist.com/en/blog/208193691/The_Madi_Campaign_Part_II ~~www.securelist.com~~		\|Link=http://www.securelist.com/en/blog/208193691/The_Madi_Campaign_Part_II
	\|Author=Nicolas Brulez,		\|Author=Nicolas Brulez,
	\|NomRevue=Securelist		\|NomRevue=Securelist

Eric.freyssinet: 1 revision imported

2015-02-07T14:27:11Z

1 revision imported

← Older revision		Revision as of 14:27, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

2014-08-27T16:29:18Z

Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.securelist.com/en/blog/208193691/The_Madi_Campaign_Part_II www.securelist.com
|Author=Nicolas Brulez,
|NomRevue=Securelist
|Date=July, 26 2012
|Editor=Kaspersky lab
|Year=2012
|ISBN=
|Page=
|Abstract= our previous blogpost, we discussed the Madi campaign, uncovered through joint research with our partner Seculert.
In this blogpost, we will continue our analysis with information on the Madi infrastructure, communications, data collection, and victims.

The Madi infrastructure performs its surveillance operations and communications with a simple implementation as well. Five command and control (C2) web servers are currently up and running Microsoft IIS v7.0 web server along with exposed Microsoft Terminal service for RDP access, all maintaining identical copies of the custom, C# server manager software. These servers also act as the stolen data drops. The stolen data seems to be poorly organized on the server side, requiring multiple operators to log in and investigate the data per each of the compromised systems that they are managing over time.

The services at these IP addresses have been cycled through by the operators for unknown reasons. There does not appear to be a pattern to which malware reports to which server just yet. According to sinkhole data and other reliable sources, the approximate locations of Madi victims are distributed mainly within the Middle East, but some are scattered lightly throughout the US and EU. It seems that some of the victims are professionals and academia (both students and staff) running laptops infected with the Madi spyware, travelling throughout the world:
|Botnet=Madi,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}

The Madi campaign - Part II - Revision history

Eric.freyssinet: Text replacement - " www.securelist.com" to ""

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »