Skip to content

[Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident, (Wed, Apr 22nd)

73
Expert
Chimera Difficulty Score
a synthesis of Flesch-Kincaid, Coleman-Liau, SMOG, and Dale-Chall readability metrics
[Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident by L. Carty, SANS.edu BACS Student (Version: 1) [This is a Guest Diary by L. Carty, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecurity (BACS) program [1].] Introduction A few weeks ago, my honeypot logged an incident that changed how I think about mod...
This incident reveals a troubling evolution in threat actor tactics, where credential harvesting is prioritized alongside traditional resource exploitation. The attack chain demonstrates a calculated approach: initial access via weak SSH credentials, followed by systematic reconnaissance to identify high-value targets like Telegram's tdata folder. The tdata directory's vulnerability lies in its ability to bypass 2FA entirely, granting threat actors persistent access to accounts. This aligns with...