← Threat archive

T1190 Exploit Public-Facing Application

2 threats tracked by Spectrum Delta use this technique.

T1190 on MITRE ATT&CK →

  • Volt Typhoon Silent Train

    Relay compromised via exposed web interface, minimal tooling deployed for chained SSH

    Edge device web-management logins from unusual sources; new SSH service binds; SSH keys/configs created on devices that normally run none; flow records of device-to-VPS and device-to-device SSH chains

    Zero-day exploitation of edge and management platforms for admin control and downstream reach

    Admin logins to SD-WAN orchestrator, RMM, Versa Director or KACE consoles from relay ASNs, residential ranges or during China Standard Time hours; new admin accounts and credential changes after edge exploitation

    Seen in: Edge device management, NetFlow / flow telemetry, SD-WAN/RMM console logs

  • ARTEX Okta/Entra spray campaign

    Exploit public-facing application (attempted): tenant-isolation testing

    HTTP access logs: registration (201) and confirmation (200) from disposable-email identities followed by 403/401 responses on cross-tenant and admin-redirect attempts; mass-denied patterns are the correlate

    Seen in: Web / HTTP access logs