Baja INVOLVES Apache module issue
The Baja attack involved an Apache module issue.
Explicit Confidence 99% · Craig Jones EP 174 Details
“It was an Apache module issue”
Incident
incident:baja
Internal Sophos code name for a later Pacific Rim attack that bypassed hot fixes and used web shells on targeted firewalls.
Internal Sophos code name for a later Pacific Rim attack that bypassed hot fixes and used web shells on targeted firewalls.
“they give this attack a nickname, Baja”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Apache module issue | Explicit | 174 |
| outgoing | INVOLVES | Local privilege escalation | Explicit | 174 |
| outgoing | INVOLVES | web shell | Explicit | 174 |
| incoming | INVOLVES | Pacific Rim Campaign | Explicit | 174 |
Baja INVOLVES Apache module issue
The Baja attack involved an Apache module issue.
Explicit Confidence 99% · Craig Jones EP 174 Details
“It was an Apache module issue”
Baja INVOLVES Local privilege escalation
The Baja attack chained the Apache module issue with local privilege escalation.
Explicit Confidence 99% · Craig Jones EP 174 Details
“It was an Apache module issue and it was chained with a local privilege escalation”
The attackers used web shells to obtain direct remote access to Sophos Firewalls.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they’re putting just regular old web shells on the firewalls”
Pacific Rim Campaign INVOLVES Baja
Baja was another named attack in the Pacific Rim Campaign.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they give this attack a nickname, Baja”