Energetic Bear/Crouching Yeti: attacks on servers - Securelist

## Executive summary Kaspersky Lab ICS CERT documents Energetic Bear/Crouching Yeti activity against internet-facing servers (2016–early 2017), describing waterhole infections that exfiltrate SMB/NTLM credentials, deployment of obfuscated PHP web shells and a modified sshd backdoor, use of open-source scanning/exploitation tools and SQL injection activity, and provides indicators of compromise (file paths, hashes, logs, YARA rule and detection scripts) to help defenders identify and remediate affected hosts.