Executive Summary

• SGI sensors observed network activity from IP address 159.65.148.152 involving the transfer of a text file.
• The file, identified as ‘20250816-092517-11ed1fe18a98-0-redir__dev_null’, is suspected to be a redirection script.
• The likely objective is to redirect network traffic, potentially for malicious purposes such as phishing or data exfiltration.
• The initial risk level is assessed as low, pending further analysis.
• Organizations should monitor network traffic for similar activity and implement appropriate blocking rules.

We anticipate an increase in similar low-complexity redirection attempts to bypass traditional security filters.

Observed Activity (SGI Sensors)

On November 9, 2025, at 09:13:11 UTC, SGI sensors detected network activity originating from IP address 159.65.148.152, located in Bāshettihalli, Karnataka, India. The source ASN is AS14061, belonging to DigitalOcean, LLC. The communication occurred over TCP. The transmitted payload contained a text file, and its SHA256 hash is 1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057. The file’s name suggests a potential redirection script targeting /dev/null.

Malware/Technique Overview

The detected file is classified as part of the ‘20250816-092517-11ed1fe18a98-0-redir__dev_null’ malware family. Given the filename and the traffic pattern, it’s likely a script designed to redirect traffic to the null device (/dev/null), potentially disrupting network services or obscuring malicious activity. The initial access vector is assumed to be through a compromised system or misconfigured service allowing arbitrary file uploads or execution.

• T1071 – Application Layer Protocol
• T1573 – Encrypted Channel
• T1105 – Ingress Tool Transfer

VirusTotal Snapshot

VirusTotal analysis shows that 0 vendors flagged the file as malicious, while 62 vendors did not detect it. The file is described as text. These results suggest that the file may be a newly created or obfuscated script not yet recognized by many AV engines.

• VirusTotal Sample

Indicators of Compromise (IoCs)

It is recommended to monitor these IoCs for at least 30 days.

Detection & Hunting

Splunk SPL

index=* hash="1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057" OR src_ip="159.65.148.152"

This query searches for events containing the identified hash or originating from the observed IP address. Validate potential hits by examining network connections and process execution details to filter out false positives.

Containment, Eradication & Recovery

1. Isolate affected systems from the network to prevent further propagation.
2. Block the identified IP address (159.65.148.152) at the firewall level.
3. Scan all systems for the presence of the identified file hash (1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057).
4. Reimage any compromised systems to ensure complete eradication.
5. Reset any potentially compromised credentials.

Communicate the incident to relevant IT and leadership stakeholders. Preserve evidence for potential forensic analysis.

Hardening & Preventive Controls

Prioritize the following preventive controls, mapped to the NIST Cybersecurity Framework (CSF) and CIS Controls:

• Implement Multi-Factor Authentication (MFA): Protect against credential compromise (NIST CSF: PR.AC-1, CIS Control 6).
• Tune Endpoint Detection and Response (EDR) Systems: Enhance detection capabilities for suspicious file execution and network activity (NIST CSF: DE.CM-1, CIS Control 8).
• Implement Network Segmentation: Limit the blast radius of potential compromises (NIST CSF: PR.AC-4, CIS Control 14).
• Enforce Least Privilege: Restrict user and application permissions to only what is necessary (NIST CSF: PR.AC-3, CIS Control 5).
• Establish Patch SLAs: Ensure timely patching of vulnerabilities (NIST CSF: PR.MA-1, CIS Control 7).

Business Impact & Risk Outlook

The potential business impact includes disruption of network services, data exfiltration, and reputational damage. Legal risks could arise from data breaches resulting from successful redirection attacks. We anticipate an increase in the use of simple redirection scripts to bypass security controls over the next 3-6 months, requiring enhanced monitoring and detection capabilities.

Appendix

Redacted Payload Snippet

#!/bin/bash
# Redirection script example
echo "Redirecting traffic to /dev/null"
# ... [Redacted for brevity] ...

Assumptions & Data Gaps

• Sensor Name is unavailable.
• Network Port is unavailable.

References

• VirusTotal Sample

Protect your organization from emerging threats with SGI’s comprehensive security solutions. Request an Incident Readiness Review to assess your current posture and identify vulnerabilities. Benefit from round-the-clock protection with 24/7 Monitoring with Sentry365™, and gain expert guidance with our vCISO Advisory services.