The attacker may have used the malware to check for antivirus-related processes running in the system.
Tag: T1592
Inside Water Barghests Rapid Exploit
Water Barghest actively scans the internet for vulnerable IoT devices, particularly those with known vulnerabilities or default credentials. Upon identifying a vulnerable device, they exploit it to gain initial access. This may involve exploiting vulnerabilities in web interfaces, using default or weak credentials, or leveraging unpatched software flaws.