Incident
incident:defcon_financial_data_exfiltration
Unnamed financial organization's recurring transfer of financial transactions and trades to an external FTP server over approximately six months.
Unnamed financial organization's recurring transfer of financial transactions and trades to an external FTP server over approximately six months.
“That happened every night at 1:00 in the morning for six months”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | FTP | Explicit | 157 |
| outgoing | INVOLVES | Data exfiltration | Explicit | 157 |
| outgoing | ASSOCIATED_WITH | Russia | Uncertain | 157 |
Defcon financial-data exfiltration INVOLVES FTP
The financial-data exfiltration incident involved recurring FTP traffic to a host in a .ru domain.
Explicit Confidence 99% · Grifter EP 157 Details
“We look and it’s FTP traffic going to a host name, not even an IP address but a host name that ends in .ru”
Defcon financial-data exfiltration INVOLVES Data exfiltration
The incident involved nightly transmission of a zip file containing the organization’s financial transactions and trades.
Explicit Confidence 99% · Grifter EP 157 Details
“that is every financial transaction and trade that we’ve made in the last twenty-four hours”
Defcon financial-data exfiltration ASSOCIATED_WITH Russia
The incident was associated with Russia because the FTP server connection and its IP address were identified as being in Russia; the episode does not establish who operated the server.
Uncertain Confidence 93% · Grifter EP 157 Details
“That connection to an FTP server in Russia — the IP address was also geolocated to Russia”