Micah Lee 🫡

@micahflee ↗

Deleted No

Hibernated No

Last Checked Jan. 10, 2021

Created

Tue Dec 22 20:57:48 +0000 2020

Likes

Retweets

Source

Twitter Web App

View Raw Data

JSON Data

View on Twitter

Likely Available

Micah Lee 🫡 @micahflee

Microsoft Threat Intelligence Center (MSTIC) has also been investigating this hacking campaign (again, this is separate from SolarWinds) and alerted some of their customers about it, including sending a list of Indicators of Compromise (IOCs) so they can see if they were hacked — PolitiTweet.org

Posted Dec. 22, 2020

Preceded By

Micah Lee 🫡 @micahflee

CISA also published this heatmap of targets (not all of them confirmed compromised). In addition to Austin, Berserk Bear targeted 75 airports, 4 airlines, 13 cities, 4 counties, 3 states, and dozens of orgs in aviation, defense, tech, healthcare, etc. https://t.co/95zhMh3ecB https://t.co/2ORWbDh1WX — PolitiTweet.org

Posted Dec. 22, 2020

Followed By

Micah Lee 🫡 @micahflee

The list of IOCs included an IP owned by the city of Austin. (The next day MSTIC then updated their IOCs to remove this IP.) In other words, it looks like Microsoft saw this IP, part of Austin's network, being used as infrastructure in this massive hacking campaign. — PolitiTweet.org

Posted Dec. 22, 2020