Feb2023-CVE-2021-21974-OSINT

Analysis of the ransom demands from Shodan results and Censys

For Shodan:

I've provided a script that you can use as a basis for your own analysis, or to update and gather more results as Shodan scrapes them. I've also included a python script that can be used to query the blockstream.info API for any wallet addresses with associated transactions.

At the time of this publication, there were over 500 results. Those results can be found in the provided CSV where the Ransom amount, Bitcoin wallet, and TOX ID are all listed.

For Censys:

I used the Censys API to collect all listed impacted IPs (2,559). I then scanned each IP, and if that IP was still showing a Crypto wallet address, I scraped the results into the censys text file. There are 1733 crypto addresses still up at the time of this update (2-5-23)