OpRussia - Revision history

Booda: /* Media Coverage */

2022-06-09T14:25:55Z

Media Coverage

← Older revision		Revision as of 14:25, 9 June 2022
Line 20:		Line 20:
	== Media Coverage ==		== Media Coverage ==

			* https://www.ibtimes.com/anonymous-breaches-top-russian-law-firm-global-clients-dumps-data-protected-attorney-3532738
	* https://theintercept.com/2022/04/22/russia-hackers-leaked-data-ukraine-war/		* https://theintercept.com/2022/04/22/russia-hackers-leaked-data-ukraine-war/
	* https://meduza.io/en/feature/2022/04/13/the-hunt-for-antimilitarism		* https://meduza.io/en/feature/2022/04/13/the-hunt-for-antimilitarism

Booda at 00:22, 28 April 2022

2022-04-28T00:22:12Z

← Older revision		Revision as of 00:22, 28 April 2022
Line 7:		Line 7:
	For a lot (not all) of the Russian email leaks the recon process was:		For a lot (not all) of the Russian email leaks the recon process was:

	* 1. Shodan dorks: country:"RU", http.title:"outlook", http.title:"OWA", http.title:"Autodiscovery", http.title:"Microsoft Exchange" and then download the results ~~(You may also search for the CVE)~~.		* 1. Shodan dorks: country:"RU", http.title:"outlook", http.title:"OWA", http.title:"Autodiscovery", http.title:"Microsoft Exchange", vuln:"cve-2021-34473" and then download the results.
	* 2. Parse out the IP's from the list: grep -E -o "(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)" file1 > file2		* 2. Parse out the IP's from the list: grep -E -o "(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)" file1 > file2
	* 3. Then parse out vulnerable to non-vulnerable, exploitable to non-exploitable: nmap --script http-vuln-exchange-proxyshell.nse -iL file2 -oA file3 -p 443 [2]		* 3. Then parse out vulnerable to non-vulnerable, exploitable to non-exploitable: nmap --script http-vuln-exchange-proxyshell.nse -iL file2 -oA file3 -p 443 [2]

Mango at 20:58, 27 April 2022

2022-04-27T20:58:03Z

← Older revision		Revision as of 20:58, 27 April 2022
Line 20:		Line 20:
	== Media Coverage ==		== Media Coverage ==

	* https://theintercept.com/2022/04/22/russia-hackers-leaked-data-ukraine-war/~~?utm_medium=social&utm_campaign=theintercept&utm_source=twitter~~		* https://theintercept.com/2022/04/22/russia-hackers-leaked-data-ukraine-war/
			* https://meduza.io/en/feature/2022/04/13/the-hunt-for-antimilitarism
			* https://www.pravda.com.ua/eng/news/2022/04/24/7341811/
	* https://www.theverge.com/2022/4/22/23036079/russian-emails-leaked-ddosecrets		* https://www.theverge.com/2022/4/22/23036079/russian-emails-leaked-ddosecrets
	* https://www.ibtimes.com/anonymous-affiliate-nb65-hacks-russian-state-network-leaks-900000-emails-3461648		* https://www.ibtimes.com/anonymous-affiliate-nb65-hacks-russian-state-network-leaks-900000-emails-3461648
Line 28:		Line 30:

	== Partners ==		== Partners ==
			* https://twitter.com/xxNB65
	* https://twitter.com/DepaixPorteur		* https://twitter.com/DepaixPorteur
	* https://twitter.com/B00daMooda		* https://twitter.com/B00daMooda

Mango at 20:55, 27 April 2022

2022-04-27T20:55:46Z

← Older revision		Revision as of 20:55, 27 April 2022
Line 1:		Line 1:
	A lot of Russian based companies have been having their servers blown wide open and emails flying out all over the place for the world to read. Leaks nearing a MILLION ~~plus~~ and ~~continues! When Russia made the decision to illegally enter another country hackers all around~~ the ~~world realised that~~ Russia ~~was fair game~~ and the ~~chances of prosecution for non-Russian hackers is next to non because who really cares if you hack~~ a ~~country widely known for hacking other countries and holding them for ransom~~ in the ~~sum of millions and killing untold amount of innocents in the country of Ukraine?~~		A lot of Russian based companies have been having their servers blown wide open and emails flying out all over the place for the world to read. Leaks nearing ten MILLION files and continuing. The hacks have followed the Russia's invasion in Ukraine and the targets have included banks, government institutions, investment firms, power generation infrastructure, oil and mining companies, a weapons manufacturer in Belarus, as well as the Russian Orthodox Church.

	== Explanation of the Hack ==		== Explanation of the Hack ==

Booda at 19:18, 26 April 2022

2022-04-26T19:18:07Z

← Older revision		Revision as of 19:18, 26 April 2022
Line 1:		Line 1:
	A lot of Russian based companies have been having their servers blown wide open and emails flying out all over the place for the world to read. Leaks nearing a MILLION plus and continues! When Russia made the decision to illegally enter another country hackers all around the world realised that Russia was fair game and the chances of prosecution for non-Russian hackers is next to non because who really cares if you hack a country widely known for hacking other countries and ~~holing~~ them for ransom in the sum of millions and killing untold amount of innocents in the country of Ukraine?		A lot of Russian based companies have been having their servers blown wide open and emails flying out all over the place for the world to read. Leaks nearing a MILLION plus and continues! When Russia made the decision to illegally enter another country hackers all around the world realised that Russia was fair game and the chances of prosecution for non-Russian hackers is next to non because who really cares if you hack a country widely known for hacking other countries and holding them for ransom in the sum of millions and killing untold amount of innocents in the country of Ukraine?

	== Explanation of the Hack ==		== Explanation of the Hack ==

Booda: /* Media Coverage */

2022-04-26T02:46:33Z

Media Coverage

← Older revision		Revision as of 02:46, 26 April 2022
Line 24:		Line 24:
	* https://www.ibtimes.com/anonymous-affiliate-nb65-hacks-russian-state-network-leaks-900000-emails-3461648		* https://www.ibtimes.com/anonymous-affiliate-nb65-hacks-russian-state-network-leaks-900000-emails-3461648
	* https://securityaffairs.co/wordpress/129576/hacktivism/anonymous-huge-data-dump.html		* https://securityaffairs.co/wordpress/129576/hacktivism/anonymous-huge-data-dump.html
	* https://www.nytimes.com/2022/04/22/us/politics/hackers-russia-cyberattacks.html
	* https://www.ibtimes.com/anonymous-starts-huge-data-dump-will-blow-russia-away-leaks-rostproekt-emails-3452789		* https://www.ibtimes.com/anonymous-starts-huge-data-dump-will-blow-russia-away-leaks-rostproekt-emails-3452789
	* https://www.dailymail.co.uk/news/article-10692617/Anonymous-leaks-nearly-MILLION-Russian-state-media-emails.html		* https://www.dailymail.co.uk/news/article-10692617/Anonymous-leaks-nearly-MILLION-Russian-state-media-emails.html

Booda: /* Media Coverage */

2022-04-26T02:45:36Z

Media Coverage

← Older revision		Revision as of 02:45, 26 April 2022
Line 20:		Line 20:
	== Media Coverage ==		== Media Coverage ==

			* https://theintercept.com/2022/04/22/russia-hackers-leaked-data-ukraine-war/?utm_medium=social&utm_campaign=theintercept&utm_source=twitter
	* https://www.theverge.com/2022/4/22/23036079/russian-emails-leaked-ddosecrets		* https://www.theverge.com/2022/4/22/23036079/russian-emails-leaked-ddosecrets
	* https://www.ibtimes.com/anonymous-affiliate-nb65-hacks-russian-state-network-leaks-900000-emails-3461648		* https://www.ibtimes.com/anonymous-affiliate-nb65-hacks-russian-state-network-leaks-900000-emails-3461648

Booda: /* Explanation of the Hack */

2022-04-25T01:57:40Z

Explanation of the Hack

← Older revision		Revision as of 01:57, 25 April 2022
Line 5:		Line 5:
	For Russia we realised that a lot of companies and organisations haven't yet fully patched their exchange servers and many are still vulnerable to proxyshell! We then went out and tried to find as many high profile targets who were vulnerable as possible and then leak their emails to ddosecrets [1].		For Russia we realised that a lot of companies and organisations haven't yet fully patched their exchange servers and many are still vulnerable to proxyshell! We then went out and tried to find as many high profile targets who were vulnerable as possible and then leak their emails to ddosecrets [1].

	For a lot of the Russian email leaks the recon process was:		For a lot (not all) of the Russian email leaks the recon process was:

	* 1. Shodan dorks: country:"RU", http.title:"outlook", http.title:"OWA", http.title:"Autodiscovery", http.title:"Microsoft Exchange" and then download the results (You may also search for the CVE).		* 1. Shodan dorks: country:"RU", http.title:"outlook", http.title:"OWA", http.title:"Autodiscovery", http.title:"Microsoft Exchange" and then download the results (You may also search for the CVE).

Booda at 21:14, 23 April 2022

2022-04-23T21:14:10Z

← Older revision		Revision as of 21:14, 23 April 2022
Line 33:		Line 33:
	* https://twitter.com/wh1t3sh4d0w0x90		* https://twitter.com/wh1t3sh4d0w0x90

	[[Category:Hacks Cyberwar]]		[[Category:Hacks]]
			[[Category:Cyberwar]]

Booda at 21:13, 23 April 2022

2022-04-23T21:13:40Z

← Older revision		Revision as of 21:13, 23 April 2022
Line 33:		Line 33:
	* https://twitter.com/wh1t3sh4d0w0x90		* https://twitter.com/wh1t3sh4d0w0x90

	[[Category:Hacks]]		[[Category:Hacks Cyberwar]]