nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7lgy0rj5a2nwpnyc4hup6ufpfz7wz6dzcgd3crm6fm2yd34dcz0q4lg4vn Right but the server was compromised between September and December, which maps to tho...
@nprofile1q... @nprofile1q...
Indicators of compromise of users would look like post exploit behavior of an RCE vuln in the auto updater process... I haven't looked at details, but if you have process logging (4688s), if you find processes started by the notepad++ process, that is your haystack (not all updates would have been targeted, let's say...) to find the needles, you'll need to go hunting for the malicious update returned by hostile auto updater service.
Indicators of compromise of users would look like post exploit behavior of an RCE vuln in the auto updater process... I haven't looked at details, but if you have process logging (4688s), if you find processes started by the notepad++ process, that is your haystack (not all updates would have been targeted, let's say...) to find the needles, you'll need to go hunting for the malicious update returned by hostile auto updater service.