Author

Matt Lembright

4 posts

Federal / Government Research Threat Intelligence

Discovery of NTC Vulkan Infrastructure

In March 2023, various media outlets published details from documents received in February of 2022 from a former NTC Vulkan employee who opposed Russia’s invasion of Ukraine. Moscow-based NTC Vulkan, the outlets reported, was contracted by Russian intelligence to create the following offensive cyber tools: In this investigation, Censys researchers discovered six hosts […]

· 6 min read
Ransomware

Russian Ransomware C2 Network Discovered in Censys Data

Around June 24 2022, out of over 4.7 million hosts Censys observed in Russia, Censys discovered two Russian hosts containing an exploitation tool, Metasploit, and Command and Control (C2) tool, Deimos C2. Historical analysis indicated one of these Russian hosts also used the tool PoshC2. These tools allow penetration testers and hackers to gain access […]

· 5 min read
Critical Infrastructure Ransomware

One Year Later: 3 Insights Into the Colonial Pipeline Attack and Gas & Oil Critical Infrastructure

On May 7, 2021, the FBI was “notified of a network disruption at Colonial Pipeline.” The public later learned, and the FBI confirmed, that this disruption was due to a ransomware attack perpetrated by the Russian-speaking DarkSide ransomware gang, based out of Eastern Europe. A look into the 2021 Colonial Pipeline ransomware attack This attack […]

· 5 min read