The RSA FirstWatch Threat Intelligence team has received reports that the campaign has modulated from ports 80 to 81 and 443. This is not terribly uncommon however, it is noteworthy in the course of conducting on premise investigations or malware analysis. The RSA FirstWatch Threat Intelligence team will continue to monitor the associated behaviors of the campaign and promote notifications here, within the RSA NetWitness community, our official blog located here. For more information please contact us at rsafirstwatch@rsa.com.
