search

rcfontana / ThreatHuntingProcess

A transparent Threat Hunting Process that can be followed and adapted to your organization.
2 stars 0 forks source link

JD_Caffeine-Ransomware_Syslog_0221 #3

Open rcfontana opened 3 years ago

rcfontana commented 3 years ago

John Doe (Threat Intel): There's a new actor spreading an IOT ransomware variant across small devices. Our latest intel shows the CaffeineMonster actor is also targeting coffee machine devices and using their CPU resources to mine Monero. Once the machine is infected, coffee prices changes to 0.01 XMR. While the machine is idle it mines Monero.

rcfontana commented 3 years ago

I know it sounds serious as this request comes from the Threat Intel team, but we don't really have that data source available for hunting :/ Maybe we could raise this to the CISO and add the coffee machines to our crown jewels.

rcfontana commented 3 years ago

Wait.. 0.01 XMR is cheaper than what we pay now.