topic Re: Malicius file download and lateral movement detected over Quantum gateway data in XDR

Malicius file download and lateral movement detected over Quantum gateway data

tamaral — Wed, 23 Apr 2025 13:59:49 GMT

Hi guys,
See the brief below, showcasing additional detections and correlations over Quantum Gateway used to stop lateral movement using a malicious script.

Re: Malicius file download and lateral movement detected over Quantum gateway data

the_rock — Wed, 23 Apr 2025 15:12:07 GMT

Interesting...I checked both external IPs you listed and first one was not found at all in below database and 2nd one says about 12500 times.

Andy

AbuseIPDB - IP address abuse reports - Making the Internet safer, one IP at a time

Re: Malicius file download and lateral movement detected over Quantum gateway data

tamaral — Wed, 23 Apr 2025 15:24:31 GMT

Actually, now they are both reported in Abuse, but not sure it was the case at the time,

87.121.84.37 - 100% confidence

193.32.162.27 - 26% confidence

Thanks for replaying, Andy!!

Re: Malicius file download and lateral movement detected over Quantum gateway data

the_rock — Wed, 23 Apr 2025 15:27:41 GMT

Kind of odd when I checked 15 mins ago, was clean, showing Italy and now shows Netherlands, 100% confidence lol

Anyway, thanks for checking!

Andy

Re: Malicius file download and lateral movement detected over Quantum gateway data

the_rock — Wed, 23 Apr 2025 15:51:10 GMT

Thanks again for looking into it, appears its listed below as well.

Cheers,

Andy

https://www.apivoid.com/tools/ip-reputation-check/