Block Selenium Grid services currently being used for Cryptomining

[summercms]

Enhancement idea

• Block Selenium Grid services currently being used for Cryptomining.

Description

An ongoing threat campaign dubbed “SeleniumGreed” that exploits exposed Selenium Grid services to deploy cryptominers. Selenium is a popular open-source suite used for testing web applications, allowing users to write tests that simulate user interactions across different browsers and environments.

Screenshots

n/a

Links

https://www.wiz.io/blog/seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps

IOC

I2P websites

n/a

IPFS websites

n/a

Tor2web websites

n/a

TOR websites

n/a

URL's

n/a

Folders

n/a

Sub-Domains

n/a

Domains

n/a

IP's

164.90.149.104
165.22.195.35
165.227.63.241
192.241.144.69

ASN's

n/a

Emails

n/a

Wallet addresses

n/a

Mining pool addresses

n/a