P. Diddy hotel compromise INITIAL_ACCESS_VIA phishing
The hotel compromise began with a phishing email crafted to appear to come from another hotel employee.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“it started with a phishing e-mail”
Incident
incident:p_diddy_hotel_compromise
Also: Sean Puffy Combs hotel incident
Hotel network compromise involving phishing, lateral movement, access to security cameras and hotel systems, and theft and use of payment-card information.
Hotel network compromise involving phishing, lateral movement, access to security cameras and hotel systems, and theft and use of payment-card information.
“we managed to get access to an internal machine in a hotel”
“we performed some lateral movement and gained access to some other machines on the network”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 109 |
| outgoing | INVOLVES | Malware | Explicit | 109 |
| outgoing | INVOLVES | lateral movement | Explicit | 109 |
P. Diddy hotel compromise INITIAL_ACCESS_VIA phishing
The hotel compromise began with a phishing email crafted to appear to come from another hotel employee.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“it started with a phishing e-mail”
P. Diddy hotel compromise INVOLVES Malware
The attached application in the phishing email was malware that gave TeaMp0isoN access to a hotel computer.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“the app was malware, so when the employee opened it, it gave TeaMp0isoN access to the computer in the hotel”
P. Diddy hotel compromise INVOLVES lateral movement
After gaining access, the attackers performed lateral movement to other machines on the hotel network.
Explicit Confidence 99% · MLT EP 109 Details
“we performed some lateral movement and gained access to some other machines on the network”