More weirdness on TCP port 26

Published: 2021-02-16
Last Updated: 2021-02-16 18:19:15 UTC
by Jim Clausing (Version: 2)
2 comment(s)

A little over a year ago, I wrote a diary asking what was going on with traffic on TCP port 26. So, last week when I noticed another spike on port 26, I decided to take another look.

Update: In the original version of this diary, I accidentally left out the graph below.

This time around, again based on looking at my honeypot traffic, it looks like a possible new variant of Satori. I'm still not sure why they are expecting to find telnet on port 26, but this is what I'm seeing in the honeypot.

It looks like it might be slowing down a little since the initial spike in the middle of last week, but this is still more traffic than we've seen on port 26 since the the big increase I wrote about last time. If anyone has anymore insight into this one, please let us know via our contact page, e-mail, or comment below.

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu

Keywords: satori tcp port 26
2 comment(s)

Comments

Jim, thanks for the post. I will be on the lookout for this traffic. Have you seen this? http://codegrazer.com/blog/rsftp-to-command-injection.html
Jim, thanks for the post. I will be on the lookout for this traffic. Have you seen this? http://codegrazer.com/blog/rsftp-to-command-injection.html

Diary Archives