Anyone running #archiveteamwarrior here?
I've gotten an email from my ISP that #malware (Tinba/avalanche/ranbyus/nymaim/generic) has been found communicating on my network for the past couple days.
I received a list of reports with my IP address, which was detected by shadowserver.org and cert-bund.de for attempting to reach the destination IP address 216.218.185.162, which is controlled as a sinkhole by shadowserver.org
The list also tells me that it wasn't active over the last weekend, which is where my Warriors had stopped working without me noticing.
The detection mostly happened at times when just my IoT stuff and my Warrior-VMs were running. I've shut them down now and will continue to monitor the situation, as I've already checked most of my devices by now. But I highly suspect the Warriors to be the cause, having crawled specific sites that triggered this report.
Does anyone have more information about this or similar things happening before? Do I need to do any additional steps?