I have a firewall keeps popping up a blocked set of packets from ransomware called "conti" originating at my hyperV Hypervisor machine.

By Guest bed1m
July 26, 2022 in Tech Support & Discussions Forum

https://extremetechsupport.com/topic/1035732-i-have-a-firewall-keeps-popping-up-a-blocked-set-of-packets-from-ransomware-called-conti-originating-at-my-hyperv-hypervisor-machine/

Followers 0

Recommended Posts

Guest bed1m

Posted July 26, 2022

Hello, I have a Cisco Meraki Firewall AMP, which has started blocking packets from what it things are an infection of ransomwhere called "Conti" Variant. The packest certainly look suspicious, but this is a ServerCore 2022 HyperV hypervisor and the only 3rd party software is communication softare from APC for shutting down the machine in case of UPS failure. the Built in firewall and Defender stuff is running and up to date and turns up nothing and I ran MSERT and it too turned up nothing. The packets are sent out only saturday and sunday and appear to be going to my management workstati