RediShell - Kinsing Lab

Before the ransomware deployment, the attackers established initial access through a misconfigured CI/CD server running in a Docker container within Wowza's development network. Security monitoring detected unusual outbound connections from the container subnet to a suspicious external IP address. A packet capture was initiated automatically but was terminated when the attacker discovered and killed the monitoring process. Your task is to analyze this network traffic to understand how the attackers gained their initial foothold and moved laterally within the containerized environment.

Q1: Security monitoring flagged suspicious HTTP traffic targeting the container subnet. What private IP address was the first to receive malicious requests?

What are we looking for?

We need to identify the first internal host that the attacker actively targeted with malicious HTTP traffic, this is the entry point of the intrusion.

Where will we find the attack evidence?

Since the attacker's traffic is HTTP-based, every request and response is fully visible in the capture. We can find the earliest malicious activity by filtering broadly on HTTP requests and narrowing down to whichever port shows suspicious, repeated activity.

How can we search the data to see it?

Filtering on http.request across the whole capture, port 8080 traffic to 172.16.10.10 appears near the very start, while port 80 and port 8000 traffic to other hosts only shows up much later.

Narrowing further with http.request && tcp.port==8080, the exchange starts at packet 13, with the destination consistently appearing as the same host across the run.

To confirm this is genuinely malicious rather than routine CI/CD chatter, we follow the HTTP stream for one of the early POST requests. The form body decodes to script=println+%27id%27.execute%28%29.text, an attempt to execute the id command on the server, so this confirms this is our targeted server.

Answ…