topic Re: infected with techunity.tc.b in Spark Firewall (SMB)

infected with techunity.tc.b

Rodney-dannevig — Fri, 20 Aug 2021 22:36:14 GMT

I have in infected devices on the Checkpoint 790 Appliance saying the router is infected with the techunity.tc.b

I found it because I am having issue with an RDP brute force attach originating from the external ip of the same checkpoint.

I do have RDP NAT but to another server with IP restrictions.

I turned off the RDP NAT and it still happens originating from the router.

Any suggestions would be great.

Re: infected with techunity.tc.b

PhoneBoy — Sat, 21 Aug 2021 02:01:37 GMT

Not sure why you posted this in the DevSecOps group.
Also “the router is infected” what precise information did you see?
Screenshots (redacting sensitive data) would be helpful, as would the precise firmware version and build.

Some details about the malware in question: https://threatpoint.checkpoint.com/ThreatPortal/threat?threatType=malware&threatId=32312779
General remediation steps: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106019

Re: infected with techunity.tc.b

Rodney-dannevig — Sat, 21 Aug 2021 16:50:34 GMT

Sorry about that will Close the question.

Re: infected with techunity.tc.b

PhoneBoy — Sat, 21 Aug 2021 22:59:34 GMT

I moved it to the correct place, all good.