avuko / sb

Analysis of the Shadow Broker/ Equation Group dumps.

Hi there 👋

• 🔭 I’m currently working on learning Rust while (re)building https://github.com/avuko/kathe
• 🌱 I’m currently learning Rust
• 👯 I’m looking to collaborate on https://github.com/avuko/kathe
• 💬 Ask me about coffee
• 📫 How to reach me: infosec.exchange/@avuko
• 😄 Pronouns: he/him
• ⚡ Fun fact: coffee is a psychoactive drug.

sb's Issues

Good work!

Jackladder uses SMTP on ports 13 and 25: x0rz/EQGRP#33

Regarding your doubts about the choices for the targets, they all seem to have a mail server running and they belong to some big group with lot of networking. This makes them optimal choices for proxies, controlled by operational command consoles used on demand.

The geographical location follows what appears to be a rule for crime-related C2C (command & control) operations: keeping the number as sparse as possible with little differences between various countries. The interest for .ru and .cn is obvious, but there are also high numbers for .in and .pk (most probably a middle step for the focus on .cn)