Hi everyone, looks like I have a similar situation to a few people.
NO Windows machines on the network, just OSX and Linux (QNAP). Woke up to over 1400 emails regarding ATP C2/Generic-A. But the originiating seems to be from AFCd? Any idea what this is?
Googling has given me no ideas. Any ideas anyone?
Reporting in that i've gotten the same traffic today (3/20/16)
2016:03:20-00:07:09 sophosedge afcd[14692]: id="2022" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet dropped (ATP)" srcip="180.97.161.224" dstip="[my ip address]" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="pqyoebe38318.app.anmorencai.com" url="-" action="drop"
Same here on 3/20/16, in Belgium
2016:03:20-04:41:11 fwutm61-2 afcd[27912]: id="2022" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet dropped (ATP)" srcip="218.60.112.226" dstip="(OUR IP ADDRESS)" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="qFaY264ff651.app.anmorencai.com" url="-" action="drop"