Repeat Compromises
Channel Futures: Why are hosts being compromised more than once?
Huntress’ John Hammond: The exploitation vector relies on a webshell being deployed on the machine, so the attackers can access this from anywhere and run arbitrary code or commands. Any single one of these webshells can offer remote code execution. But having multiple [webshells] means the threat actor has confident redundancy. If the good guys clean up just one webshell, the bad guys can still use their backups and maintain their access. Nearly 25% of the incident reports we have sent were for hosts that have been compromised more than once.
Tags:
