IntrusionLabs / threat intelligence

Sign in

← Back to feed

169.212.6.104

TAGGED MALICIOUS how we decide →

Why: Our sensors observed malware dropper sessions · certainty: inferred

Threat Confidence

56%

Assessment

Hands-on intruder: runs interactive command sessions

Logged in with one credential in 312 of 312 logins: it returns to a host it treats as already compromised rather than guessing passwords.
Downloaded 300 files and ran 4,330 commands on the host.
Part of a 208-IP campaign from the same network, active in the same window.

Generated from the counts on this page by fixed rules; each line cites the number it rests on.

Location

🇰🇷 KR / Gimpo-si

ASN

AS4766 · Korea Telecom

Cloud Provider

—

Total Events

7330

Top 1% by volume

Agent Count

1

First / Last Seen

2026-10-17 16:03 — 2026-10-19 07:24

Attack Types

telnet:credential-reuse telnet:intrusion telnet:malware

MITRE ATT&CK Techniques

Initial Access

T1078

Execution

T1059.004

Discovery

T1016 T1082

Command and Control

T1105

External Corroboration

Not flagged by any external feeds

Campaigns

AS4766 Korea Telecom ASN Active medium 🇰🇷 KR

208 IPs 93672 events

ftp:bruteforcesmtp:relayssh:bruteforcessh:connectionssh:intrusionssh:malwaressh:proxy-abusetelnet:bruteforcetelnet:connectiontelnet:credential-reusetelnet:intrusiontelnet:malware

2026-02-18 — ongoing · 208 IPs from the same network (Korea Telecom, AS4766) were active during overlapping time periods. Temporal correlation across …

Session Forensics

reconnaissance ×1 malware_dropper ×153 interactive_operator ×158

Sessions

312 (312 with login)

Avg Depth Score

0.95

Commands Executed

4330

Files Downloaded

300

Notable Commands

sh
shell
shell
enable
enable
system
system
ping; sh
CMD:
/bin/busybox HISILICON

Download URLs

http://130.12.180.212/x86_64

Evidence Timeline

Malware Dropper 4803beaac9a4 greencloud_phx_01 · 2026-10-19 07:21

17 2 1 100%

Loading events...

Interactive Operator 2ea998c5d00a greencloud_phx_01 · 2026-10-19 07:21

11 1 90%

Loading events...

Malware Dropper 4838ea439bca greencloud_phx_01 · 2026-10-19 07:06

17 2 1 100%

Loading events...

Interactive Operator b39e3622ec04 greencloud_phx_01 · 2026-10-19 07:06

11 1 90%

Loading events...

Interactive Operator 070c42fdbc2a greencloud_phx_01 · 2026-10-19 06:51

14 1 90%

Loading events...

Interactive Operator 736efcab2e92 greencloud_phx_01 · 2026-10-19 06:51

11 1 90%

Loading events...

Malware Dropper 9ab236767711 greencloud_phx_01 · 2026-10-19 06:36

17 2 1 100%

Loading events...

Interactive Operator 10f49eeebe7b greencloud_phx_01 · 2026-10-19 06:36

11 1 90%

Loading events...

Malware Dropper 00368bd3c86c greencloud_phx_01 · 2026-10-19 06:21

17 2 1 100%

Loading events...

Interactive Operator cf5422a373a9 greencloud_phx_01 · 2026-10-19 06:21

11 1 90%

Loading events...

Malware Dropper 6167c486e83d greencloud_phx_01 · 2026-10-19 06:06

15 1 1 100%

Loading events...

Interactive Operator 9606c9ed582f greencloud_phx_01 · 2026-10-19 06:06

11 1 90%

Loading events...

Malware Dropper 03af799da1fe greencloud_phx_01 · 2026-10-19 05:50

17 2 1 100%

Loading events...

Interactive Operator 62c5510222e5 greencloud_phx_01 · 2026-10-19 05:50

11 1 90%

Loading events...

Malware Dropper 26a45d58c586 greencloud_phx_01 · 2026-10-19 05:36

17 2 1 100%

Loading events...

Interactive Operator 1991a5c5eefc greencloud_phx_01 · 2026-10-19 05:36

11 1 90%

Loading events...

Malware Dropper 5c0b21341ec5 greencloud_phx_01 · 2026-10-19 05:21

17 2 1 100%

Loading events...

Interactive Operator f3da7c35ce8e greencloud_phx_01 · 2026-10-19 05:21

11 1 90%

Loading events...

Interactive Operator 7d33b437d8e5 greencloud_phx_01 · 2026-10-19 05:06

11 1 90%

Loading events...

Interactive Operator 425c42503da7 greencloud_phx_01 · 2026-10-19 05:06

11 1 90%

Loading events...

Malware Dropper 18b0fdcbd965 greencloud_phx_01 · 2026-10-19 04:51

17 2 1 100%

Loading events...

Interactive Operator 7016be718b21 greencloud_phx_01 · 2026-10-19 04:51

11 1 90%

Loading events...

Malware Dropper 01f23150effd greencloud_phx_01 · 2026-10-19 04:35

17 2 1 100%

Loading events...

Interactive Operator 73a0014662bf greencloud_phx_01 · 2026-10-19 04:35

11 1 90%

Loading events...

Malware Dropper 52a7e908d9e5 greencloud_phx_01 · 2026-10-19 04:20

17 2 1 100%

Loading events...

Interactive Operator 9459d902a006 greencloud_phx_01 · 2026-10-19 04:20

11 1 90%

Loading events...

Malware Dropper e6ea6bdd6ef3 greencloud_phx_01 · 2026-10-19 04:06

17 2 1 100%

Loading events...

Interactive Operator 224d3a76586e greencloud_phx_01 · 2026-10-19 04:06

11 1 90%

Loading events...

Malware Dropper 425fe43a80f2 greencloud_phx_01 · 2026-10-19 03:50

17 2 1 100%

Loading events...

Interactive Operator 16bf68f84630 greencloud_phx_01 · 2026-10-19 03:50

11 1 90%

Loading events...

Malware Dropper 9e66202622f1 greencloud_phx_01 · 2026-10-19 03:36

17 2 1 100%

Loading events...

Interactive Operator eaa3725bdcbc greencloud_phx_01 · 2026-10-19 03:36

11 1 90%

Loading events...

Malware Dropper 6b687f820cd9 greencloud_phx_01 · 2026-10-19 03:21

17 2 1 100%

Loading events...

Interactive Operator ee118d892506 greencloud_phx_01 · 2026-10-19 03:21

11 1 90%

Loading events...

Malware Dropper 683aa80b6b17 greencloud_phx_01 · 2026-10-19 03:05

17 2 1 100%

Loading events...

Interactive Operator e23ac63a31e2 greencloud_phx_01 · 2026-10-19 03:05

11 1 90%

Loading events...

Malware Dropper 5ea59662d2b9 greencloud_phx_01 · 2026-10-19 02:51

17 2 1 100%

Loading events...

Interactive Operator c815fe6da27b greencloud_phx_01 · 2026-10-19 02:51

11 1 90%

Loading events...

Malware Dropper dcff2a95c444 greencloud_phx_01 · 2026-10-19 02:36

17 2 1 100%

Loading events...

Interactive Operator f0000641d462 greencloud_phx_01 · 2026-10-19 02:35

11 1 90%

Loading events...

Malware Dropper 97516885f180 greencloud_phx_01 · 2026-10-19 02:21

17 2 1 100%

Loading events...

Interactive Operator 3b22740810d2 greencloud_phx_01 · 2026-10-19 02:21

11 1 90%

Loading events...

Malware Dropper c8894afda4de greencloud_phx_01 · 2026-10-19 02:06

17 2 1 100%

Loading events...

Interactive Operator 194098931d37 greencloud_phx_01 · 2026-10-19 02:06

11 1 90%

Loading events...

Malware Dropper 8c89bcb203ca greencloud_phx_01 · 2026-10-19 01:51

17 2 1 100%

Loading events...

Interactive Operator 6eeaef61da06 greencloud_phx_01 · 2026-10-19 01:51

11 1 90%

Loading events...

Malware Dropper 4c6b9d32ddb0 greencloud_phx_01 · 2026-10-19 01:35

17 2 1 100%

Loading events...

Reconnaissance a5cd6e3906dd greencloud_phx_01 · 2026-10-19 01:35

1 1 60%

Loading events...

Malware Dropper 1b974644dfd7 greencloud_phx_01 · 2026-10-19 01:20

17 2 1 100%

Loading events...

Interactive Operator 16b5328723ab greencloud_phx_01 · 2026-10-19 01:20

11 1 90%

Loading events...