Network component
network_component:vpn
Also: VPN portal, VPN tunnels, VPNs, virtual private network
Remote-access infrastructure used by the target government and found configured with default credentials.
Remote-access infrastructure used by the target government and found configured with default credentials.
“they found a VPN portal”
“That VPN was using default credentials”
A possible way of routing denial-of-service traffic through another network, mentioned in the discussion of stressors.
“he could run it through a VPN or something”
Private network-access mechanism discussed as the safer intermediary for remote administrators.
“you should probably set up a VPN for admins to connect to first”
“reinstalled their VPN, thankfully”
Virtual private network service used by Daniel during one offense and later prohibited under bail conditions.
“I only used a VPN”
“I was banned from using VPNs”
A network intermediary that Albert Gonzalez is described as requiring users to use to access ShadowCrew while traffic was logged.
“Albert set up a VPN and forced users to connect through that”
Internet-exposed remote-access infrastructure used by the hospital threat actor to enter the environment and connecting separate hospital locations.
“was able to just remote in through the VPN”
“they still needed to maintain VPN tunnels between the sites”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Daniel Kelley | Explicit | 117 |
| incoming | USES | Albert Gonzalez | Explicit | 129 |
| incoming | INITIAL_ACCESS_VIA | ThreatLocker hospital ransomware incident | Explicit | 167 |
Daniel Kelley USES VPN
Daniel used a VPN for another extortion operation and reused its Bitcoin address in the TalkTalk case, allowing investigators to link the offenses.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I had hacked and blackmailed another company without using Tor; I only used a VPN”
Albert Gonzalez USES VPN
Albert set up a VPN and required users to connect through it to access ShadowCrew.
Explicit Confidence 99% · Jack Rhysider EP 129 Details
“Albert set up a VPN and forced users to connect through that to get to the site”
ThreatLocker hospital ransomware incident INITIAL_ACCESS_VIA VPN
The threat actor obtained domain-administrator credentials from the dark web and used them to remotely access the environment through the VPN.
Explicit Confidence 99% · Hunter Clark EP 167 Details
“was able to just remote in through the VPN”