Daegu University AI Department hit by nova ransomware
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Daegu University's AI Department was compromised with 437 user credentials exposed; nova ransomware operator claims the breach.
Daegu University's AI Department fell victim to a ransomware attack claimed by the nova ransomware operation. The breach compromised seven employees' accounts directly, with 437 user credentials exposed across the infrastructure. The attacker also obtained 95 third-party employee credentials and identified 106 points on the institution's external attack surface. The incident illustrates the typical progression from credential theft via infostealer malware to ransomware deployment—a pattern where compromised employee credentials serve as an entry vector for lateral movement and encryption operations. The publicly disclosed breach listing suggests the attacker is attempting to apply pressure or shame tactics against the victim.
Mentioned in this report
Detection guidance
Inbound RDP Connection From Public IP Address
Detects an inbound RDP (TCP 3389) connection to a Windows host from a non-private source address, indicating an exposed RDP service reached with possibly stolen credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound RDP Connection From Public IP Address
id: 25dfe3cd-5c89-5721-9cda-9609cdbc2f0c
status: experimental
description: Detects inbound connections to TCP 3389 on a Windows host from a public
(non-RFC1918, non-loopback, non-link-local) source address. Compromised employee
credentials from infostealers are commonly used against externally exposed RDP before
ransomware deployment. Requires Sysmon event 3 or equivalent network telemetry that
records inbound connections.
tags:
- attack.lateral-movement
- attack.initial-access
- attack.t1021.001
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'false'
DestinationPort: 3389
filter_private:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
- ::1/128
- fe80::/10
- fc00::/7
condition: selection and not filter_private
falsepositives:
- Administrators or vendors connecting over RDP from approved public IP ranges
- RDP gateways or VPN concentrators presenting public NAT addresses
level: medium
author: Vorant
references:
- https://www.ransomware.live/id/RGFlZ3UgVW5pdmVyc2l0eSBBSSBEZXBhcnRtZW50QG5vdmE=
RDP Logon With Default Built-in Account
Detects successful remote interactive (RDP) logons using default built-in accounts such as Administrator or Guest from a remote address. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RDP Logon With Default Built-in Account
id: 98873205-e68d-5e93-a966-fb2e769bd8dc
status: experimental
description: Detects successful RemoteInteractive (type 10) logons by default accounts
such as Administrator, Guest or DefaultAccount coming from a remote address. Abuse
of default or compromised accounts over RDP is a common precursor to lateral movement
and ransomware deployment.
tags:
- attack.initial-access
- attack.persistence
- attack.lateral-movement
- attack.t1078.001
- attack.t1021.001
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 10
TargetUserName:
- Administrator
- Guest
- DefaultAccount
filter_local:
IpAddress:
- 127.0.0.1
- ::1
- '-'
condition: selection and not filter_local
falsepositives:
- Administrators who routinely use the built-in Administrator account over RDP on
lab or legacy servers
- Jump hosts where the local Administrator account is used for break-glass access
level: medium
author: Vorant
references:
- https://www.ransomware.live/id/RGFlZ3UgVW5pdmVyc2l0eSBBSSBEZXBhcnRtZW50QG5vdmE=
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/RGFlZ3UgVW5pdmVyc2l0eSBBSSBEZXBhcnRtZW50QG5vdmE=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs