IntrusionLabs IntrusionLabs
← Back to feed

5.129.35.133

TAGGED MALICIOUS how we decide →
Why: Our sensors observed interactive operator sessions · certainty: inferred
l5-129-35-133.novotelecom.ru (novotelecom.ru) ✗ FCrDNS
Threat Confidence
63%
Assessment
Hands-on intruder: runs interactive command sessions
  • Downloaded 10 files and ran 280 commands on the host.
  • Active for 16 days, 2026-10-03 to 2026-10-19.
  • Part of a 256-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇷🇺 RU / Novosibirsk
ASN
AS31200 · Novotelecom Ltd
Cloud Provider
—
Total Events
441
Top 10% by volume
Agent Count
2
First / Last Seen
2026-10-03 02:52 — 2026-10-19 17:48
Attack Types
telnet:connection telnet:intrusion telnet:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
AS31200 Novotelecom Ltd ASN Active medium 🇷🇺 RU
6 IPs 650 events
ssh:bruteforcessh:connectionssh:malwaretelnet:connectiontelnet:intrusiontelnet:malware
2026-10-03 — ongoing · 6 IPs from the same network (Novotelecom Ltd, AS31200) were active during overlapping time periods. Temporal correlation across …
Multi-Agent Scan SCAN Active medium
43 IPs 148364 events
2026-09-30 — ongoing · 43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 364181 events
2026-09-26 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 985112 events
2026-09-11 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
256 IPs 1068476 events
2026-08-03 — ongoing · 256 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
94 IPs 95242 events
2026-06-10 — ongoing · 94 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Vultr. Scanning the same …
Multi-Agent Scan SCAN Active medium
3 IPs 22451 events
2026-03-09 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
4 IPs 26325 events
2026-03-02 — ongoing · 4 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
36 IPs 39413 events
2026-02-27 — ongoing · 36 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
194 IPs 775041 events
2026-02-26 — ongoing · 194 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×7 malware_dropper ×5 interactive_operator ×13
Sessions
25 (18 with login)
Avg Depth Score
0.71
Commands Executed
280
Files Downloaded
10
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Download URLs
  • http://130.12.180.212/x86_64
Evidence Timeline
Malware Dropper 5e4cc03c6a3c greencloud_phx_01 · 2026-10-19 17:45
17 2 1 100%
Loading events...
Interactive Operator 5669bb121f0f greencloud_phx_01 · 2026-10-19 17:45
11 1 90%
Loading events...
Malware Dropper 674c2c8e68da greencloud_phx_01 · 2026-10-19 17:30
17 2 1 100%
Loading events...
Interactive Operator 694e443bd160 greencloud_phx_01 · 2026-10-19 17:30
11 1 90%
Loading events...
Malware Dropper 4dd37f492380 greencloud_phx_01 · 2026-10-19 17:15
17 2 1 100%
Loading events...
Interactive Operator 6b0061333c2e greencloud_phx_01 · 2026-10-19 17:15
11 1 90%
Loading events...
Malware Dropper dacdf330acdf greencloud_phx_01 · 2026-10-19 16:59
17 2 1 100%
Loading events...
Interactive Operator 5fce371b000c greencloud_phx_01 · 2026-10-19 16:59
11 1 90%
Loading events...
Malware Dropper bf4867270599 greencloud_phx_01 · 2026-10-19 16:44
17 2 1 100%
Loading events...
Interactive Operator ceddfe0674e4 greencloud_phx_01 · 2026-10-19 16:44
11 1 90%
Loading events...
Scanner 7066839bcb6d w4m_seattle_01 · 2026-10-19 08:52
15%
Loading events...
Scanner bbb5cdb458e7 w4m_seattle_01 · 2026-10-19 08:37
15%
Loading events...
Scanner 84fb16a5dd10 w4m_seattle_01 · 2026-10-19 08:22
15%
Loading events...
Scanner 95fecce072a2 w4m_seattle_01 · 2026-10-19 08:07
15%
Loading events...
Scanner ebad2549a1ef w4m_seattle_01 · 2026-10-19 07:52
15%
Loading events...
Scanner e6ba5d566364 w4m_seattle_01 · 2026-10-19 07:37
15%
Loading events...
Scanner f1d2b49242ef w4m_seattle_01 · 2026-10-19 07:21
15%
Loading events...
Interactive Operator f456f6b88536 greencloud_phx_01 · 2026-10-03 03:37
24 1 90%
Loading events...
Interactive Operator 63617166e8a8 greencloud_phx_01 · 2026-10-03 03:37
11 1 90%
Loading events...
Interactive Operator a3f3219e995c greencloud_phx_01 · 2026-10-03 03:22
24 1 90%
Loading events...
Interactive Operator 886a4b6f6e84 greencloud_phx_01 · 2026-10-03 03:22
11 1 90%
Loading events...
Interactive Operator 86e3e95cfd32 greencloud_phx_01 · 2026-10-03 03:07
24 1 90%
Loading events...
Interactive Operator 0165a95b5644 greencloud_phx_01 · 2026-10-03 03:07
11 1 90%
Loading events...
Interactive Operator 2b5b87a71ce6 greencloud_phx_01 · 2026-10-03 02:52
24 1 90%
Loading events...
Interactive Operator 0e64139d2cb0 greencloud_phx_01 · 2026-10-03 02:52
11 1 90%
Loading events...