Dark Web analiza eps.rs

[1van]

Drugari iz https://sosintel.co.uk/ su nam poslali još podataka:

1mln_URL48.txt:http://sapsolman1.eps.local/:vladanj:[PASSWORD_REDACTED]
sunurl-PRIVATE-22.10-2-.txt:http://imenik.eps.local/||
sunurl-PRIVATE-22.10-2-.txt:http://proxy1.eps.local/|predrag.tosic|[PASSWORD_REDACTED]
sunurl-PRIVATE-22.10-2-.txt:http://proxy3.eps.local/|eps\predrag.tosic|[PASSWORD_REDACTED]
sunurl-PRIVATE-22.10-2-.txt:http://proxy1.eps.local/|eps\predrag.tosic|[PASSWORD_REDACTED]
sunurl-PRIVATE-22.10-7-.txt:g212:1129:https://ise21.eps.local/

Daljim istraživanjem možemo da vidimo da su to:

[email protected]
[email protected]

I da, imamo i nove interne domene:

imenik.eps.local
proxy1.eps.local
proxy3.eps.local

eps-grupa.eps.local
jana2-p.eps.rs
mdm-ggm-p.eps.local
mdm-t.eps.local
piseps-p.eps.local

Da sumiramo sada imamo sa tri različita izvora detalje (slike ekrana mejl inboksa zaposlenih i detekcije honeypot-ova, saznanja o internim EPS domenima iz Stealer logova i Password dampova) o kompromitaciji EPS-a.