[nsp-sec] fyi: ogard irc c&c
Beasley, Cam
cam at infosec.utexas.edu
Sun Feb 22 14:38:26 EST 2009
fyi, we've seen a few compromised computer lab systems being controlled by
the following:
85.214.63.121:6667
174.34.156.216:6667
174.34.132.203:6667
92.243.4.222:5900
~5000 systems in this botnet last time i checked..
in our case, these machines were being popt via an infected USB thumb drive
(ongard.exe) that was being passed around by students in the lab..
~cam.
More information about the nsp-security
mailing list