🐧🐧 IronShade TryHackMe 🐧🐧

🐧Perform a compromise assessment on a Linux host and identify the attack footprints.

🐧Based on the threat intel report received, an infamous hacking group, IronShade, has been observed targeting Linux servers across the region. Our team had set up a honeypot and exposed weak SSH and ports to get attacked by the APT group and understand their attack patterns.

🐧You are provided with one of the compromised Linux servers. Your task as a Security Analyst is to perform a thorough compromise assessment on the Linux server and identify the attack footprints. Some threat reports indicate that one indicator of their attack is creating a backdoor account for persistence.

🐧Challenge🐧

Investigate the server and identify the footprints left behind after the exploitation.

Image depicting an infected Linux Machine