Kaiji 解析

IOB - Indicator of Behavior (532)

タイムライン

言語

en430
zh36
es16
ja8
fr8

国・地域

lu232
us84
cn34
es22
vn10

アクター

アクティビティ

関心

タイムライン

タイプ

ベンダー

製品

Siemens SPPA-T3000 MS3000 Migration Server16
Microsoft Windows12
Apple iOS12
Apple iPadOS12
Google Android8

脆弱性

#脆弱性BaseTemp0day本日修復EPSSCTICVE
1jforum User 特権昇格5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.002890.04CVE-2019-7550
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 情報の漏洩5.35.2$5k-$25k計算中HighWorkaround0.020160.00CVE-2007-1192
3Citrix NetScaler ADC/NetScaler Gateway OpenID openid-configuration ns_aaa_oauthrp_send_openid_config CitrixBleed メモリ破損8.38.2$25k-$100k$0-$5kHighOfficial Fix0.966680.08CVE-2023-4966
4Delta Electronics WPLSoft Modbus Data Packet メモリ破損4.24.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.000440.07CVE-2023-5460
5CODESYS Development System/Scripting 情報の漏洩7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.000520.00CVE-2023-3670
6SourceCodester Simple and Nice Shopping Cart Script uploaderm.php 特権昇格7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.001700.08CVE-2023-1497
7Honeywell MAXPRO VMS/MAXPRO NVR Web User Interface SQLインジェクション8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.001320.04CVE-2020-6960
8videowhisper Live Streaming Integration bp.php 情報の漏洩5.34.8$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.007220.00CVE-2014-1908
9Dell EMC PowerScale OneFS 弱い暗号化8.18.1$5k-$25k$5k-$25kNot DefinedNot Defined0.002010.00CVE-2022-26854
10Your Online Shop Change Name クロスサイトスクリプティング4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.000580.00CVE-2020-13911
11PostgreSQL UPDATE 情報の漏洩4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001050.03CVE-2021-32029
12Siemens SPPA-T3000 MS3000 Migration Server Service Port 5010 メモリ破損6.46.3$5k-$25k$5k-$25kNot DefinedWorkaround0.002750.04CVE-2019-18305
13Microsoft Windows GDI 情報の漏洩4.94.9$25k-$100k$0-$5kNot DefinedOfficial Fix0.024810.00CVE-2019-1439
14Microsoft Windows Graphics Component 特権昇格6.76.6$5k-$25k$0-$5kNot DefinedOfficial Fix0.000430.02CVE-2019-1433
15Campcodes Complete Web-Based School Management System show_teacher2.php クロスサイトスクリプティング3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.000001.78CVE-2024-4652
16Campcodes Complete Web-Based School Management System timetable_grade_wise.php クロスサイトスクリプティング3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.000450.56CVE-2024-4515
17SourceCodester Prison Management System user-record.php クロスサイトスクリプティング2.42.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.000450.52CVE-2024-4528
18Linux Kernel soc brcmstb_pm_probe サービス拒否5.75.5$5k-$25k$0-$5kNot DefinedOfficial Fix0.000440.04CVE-2022-48693
19LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000004.05
20Veritas NetBackup/NetBackup Appliance Alta Recovery Vault 特権昇格5.75.6$0-$5k$0-$5kNot DefinedOfficial Fix0.000430.04CVE-2024-34404

IOC - Indicator of Compromise (43)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIPアドレスHostnameアクターキャンペーンIdentifiedタイプ信頼度
15.255.111.128Kaiji2023年03月17日verified
220.187.86.47Kaiji2022年05月12日verified
320.239.156.147Kaiji2023年03月15日verified
423.94.57.16723-94-57-167-host.colocrossing.comKaiji2023年03月15日verified
523.224.85.39Kaiji2024年01月16日verified
623.224.143.170Kaiji2023年03月15日verified
736.152.201.67Kaiji2024年03月04日verified
838.242.220.166vmi1390334.contaboserver.netKaiji2023年10月17日verified
939.134.69.79Kaiji2024年02月19日verified
10XX.XX.XXX.XXxx.xx.xxx.xx.xxxxxxxxxxxxxxxx.xxxXxxxx2023年03月15日verified
11XX.XXX.X.XXXXxxxx2023年03月15日verified
12XX.XXX.XXX.XXxxxxxx.xxxxx.xxXxxxx2023年03月15日verified
13XX.XXX.XXX.XXXxxxx2023年03月15日verified
14XX.XXX.XXX.XXXXxxxx2023年12月31日verified
15XXX.XXX.XX.XXXXxxxx2022年09月29日verified
16XXX.XXX.XXX.XXxxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxxXxxxx2022年10月23日verified
17XXX.XXX.XX.XXXxxxx2023年03月15日verified
18XXX.XXX.XXX.XXXXxxxx2023年12月11日verified
19XXX.X.XXX.XXXxxxx2024年01月16日verified
20XXX.X.XXX.XXXxxxx2023年12月19日verified
21XXX.X.XXX.XXXxxxx2023年12月11日verified
22XXX.X.XXX.XXXxxxx2023年12月19日verified
23XXX.X.XXX.XXXxxxx2023年12月31日verified
24XXX.X.XXX.XXXxxxx2023年12月15日verified
25XXX.XX.XXX.XXXxxxx2024年02月03日verified
26XXX.XXX.XX.XXxxx-xxx-xxx-xx-xx.xxxxxxx.xxxxxxxx-xxx.xxxXxxxx2024年01月31日verified
27XXX.XXX.XX.XXXxxxx2023年03月15日verified
28XXX.XXX.XXX.XXXxxxx2023年12月11日verified
29XXX.XXX.XXX.XXXxxxx2023年12月11日verified
30XXX.XXX.XXX.XXXxxxx2023年12月11日verified
31XXX.X.XX.XXXxxxx2023年03月15日verified
32XXX.XX.XXX.XXXXxxxx2023年03月15日verified
33XXX.XX.XXX.XXXXxxxx2023年12月15日verified
34XXX.XX.XXX.XXXxxxx2023年12月15日verified
35XXX.XXX.XX.XXXXxxxx2023年12月11日verified
36XXX.XXX.XXX.XXXxxxx2024年01月09日verified
37XXX.XX.XXX.XXXXxxxx2024年01月19日verified
38XXX.XX.X.XXXXxxxx2023年03月15日verified
39XXX.XXX.XX.XXXXxxxx2024年03月04日verified
40XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxxXxxxx2024年01月02日verified
41XXX.XXX.XX.XXXXxxxx2024年02月22日verified
42XXX.XXX.XX.Xx.xx.xxx.xxx.xxxxx.xx.xx.xxxxxxx.xxxxxxx.xxx.xxXxxxx2023年12月11日verified
43XXX.XX.XXX.XXXxxxx2023年12月15日verified

TTP - Tactics, Techniques, Procedures (24)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueクラス脆弱性アクセスベクタータイプ信頼度
1T1006CAPEC-126CWE-21, CWE-22, CWE-23, CWE-24Path Traversalpredictive
2T1040CAPEC-102CWE-319Authentication Bypass by Capture-replaypredictive
3T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath Expressionspredictive
4T1059CAPEC-137CWE-88, CWE-94Argument Injectionpredictive
5T1059.007CAPEC-209CWE-79, CWE-80Cross Site Scriptingpredictive
6TXXXXCAPEC-122CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxxpredictive
7TXXXX.XXXCAPEC-CWE-XXXXxx Xx Xxxx-xxxxx Xxxxxxxxpredictive
8TXXXX.XXXCAPEC-16CWE-XXX, CWE-XXXXxxx-xxxxx Xxxxxxxxxxxpredictive
9TXXXXCAPEC-136CWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxxpredictive
10TXXXX.XXXCAPEC-178CWE-XXXXxxx Xxxxxxxxpredictive
11TXXXXCAPEC-1CWE-XXX, CWE-XXXXxxxxxxxxx Xxxxxxpredictive
12TXXXXCAPEC-108CWE-XXXxx Xxxxxxxxxpredictive
13TXXXXCAPEC-102CWE-XXXXxx Xx Xxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxx Xxxxxxxxxxxpredictive
14TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxx Xxxxxxxxxxxxxpredictive
15TXXXXCAPEC-112CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx Xxxxxxxxxxpredictive
16TXXXXCAPEC-37CWE-XXXXxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxpredictive
17TXXXXCAPEC-38CWE-XXXXxxxxxxxx Xxxxxx Xxxxpredictive
18TXXXX.XXXCAPEC-459CWE-XXXXxxxxxxx Xxxxxxxxxxx Xxxxxxxxxxpredictive
19TXXXX.XXXCAPEC-133CWE-XXXXxxxxxxxpredictive
20TXXXXCAPEC-116CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxxpredictive
21TXXXX.XXXCAPEC-CWE-XXXxxxxxxxxxxxxpredictive
22TXXXXCAPEC-157CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx Xxxxxxpredictive
23TXXXX.XXXCAPEC-112CWE-XXX, CWE-XXXXxx Xxxxxxxxxx Xxxxxpredictive
24TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxxpredictive

IOA - Indicator of Attack (223)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDクラスIndicatorタイプ信頼度
1File/addNotifyServletpredictive
2File/admin/booking-bwdates-reports-details.phppredictive
3File/Admin/createClass.phppredictive
4File/admin/manage-users.phppredictive
5File/Admin/user-record.phppredictive
6File/alsdemo/ss/mediam.cgipredictive
7File/api/authentication/loginpredictive
8File/api/notify.phppredictive
9File/api/v2/cli/commandspredictive
10File/application/index/common.phppredictive
11File/apps/system/router/upload.gopredictive
12File/asan/asan_interceptors_memintrinsics.cpppredictive
13File/card_scan.phppredictive
14File/cgi-bin/uploadAccessCodePicpredictive
15File/config/getuserpredictive
16File/cupseasylive/stockissuancelist.phppredictive
17File/cupseasylive/unitofmeasurementmodify.phppredictive
18File/de2api/engine/getEngine.jspredictive
19File/expense_action.phppredictive
20File/filemanager/php/connector.phppredictive
21File/forum/away.phppredictive
22File/goform/aspFormpredictive
23File/goform/fromRouteStaticpredictive
24File/goform/setUsbUnloadpredictive
25File/goform/telnetpredictive
26File/xxxxx/predictive
27File/xxxx/xxxxxx_xxxxxxxxpredictive
28File/xxx/xxxxxx/xxxxxxxxx/xxxxxxxxx.xxxpredictive
29File/xxxxxxx/xxxx.xxxpredictive
30File/xxxxx.xxxpredictive
31File/xxxxx.xxx?xxx=xxxx&xxxx=xxxxxxxx&xxxxxx=xxxxxpredictive
32File/xxxxxx/xxxxxxxxxxx.xxxpredictive
33File/xxxxx/xxx/.xxxx-xxxxx/xxxxxx-xxxxxxxxxxxxxpredictive
34File/xxx.xxxpredictive
35File/xxxxxxx/xxxxpredictive
36File/xxxxxx/xxxxx/xxxxxxxxxxxxxxxxxxxx.xxxxpredictive
37File/xxx/xxxxx/?xxxx=xxxx/xxxxxx_xxxxpredictive
38File/xxx/xxxxxx/xxxxx/xxx.xxpredictive
39File/xxxxxx/xxxx/xxxxxxx/xxx_xxxxx/xxxxxxxxxx.xxxpredictive
40File/xxxxxxxxxxxxxpredictive
41File/xxx/xxxx/xxxxxpredictive
42File/xxx/xxx/xxxxxx.xxxpredictive
43File/xxxx/xxxx_xxxxxxxx.xxxpredictive
44File/xxxx/xxxxxxxxx_xxxxx_xxxx.xxxpredictive
45File/xxxx/xxxxx/?xxxx=xxxxpredictive
46File/xxxxx/xxxxx.xxx?x=xxxxx/xxxxxxxxxxx/xxxxxxx&xxxxx=xx&xx=xpredictive
47File/xx/xxxxx.xxxpredictive
48File?x=xxxxxxx/xxxxxxxx/xxxxxx&xxxxxxxx=xpredictive
49Filexxxxxx.xxxpredictive
50Filexxxxxxx.xxxpredictive
51Filexxxxx.xxxpredictive
52Filexxxxx/xxx/xxxx.xxx.xxxpredictive
53Filexxxxx/xxxxx.xxxpredictive
54Filexxxxx/xxxxxx-xxxxxxxxxxx.xxxpredictive
55Filexxxxx/xxxxxx-xxxxxxxx.xxxpredictive
56Filexxxxx/xxxxxxxx.xxxpredictive
57Filexxxxxxxx.xxxpredictive
58Filexxxxxxxxxx.xxxpredictive
59Filexxx/xxxxxxxx/xxxxxxpredictive
60Filexxxx/xxxxxxx/xxxxxx/xxxxx_xx.xpredictive
61Filexxxx.xxxpredictive
62Filexx.xxxpredictive
63Filexx_xxxx.xxxpredictive
64Filexxx-xxx/xxxxxx/xxxxx.xxpredictive
65Filexxxxxxxxxx_xxxxxxpredictive
66Filexxxxxxx.xxxpredictive
67Filexxxx/xxxxxxxxxxxxxxx.xxxpredictive
68Filexxxxxx.xxxpredictive
69Filexxxxxxxx_xxxx_xxxxxxxxxx.xxxxpredictive
70Filexxxxxxxxxxxx.xxxxpredictive
71Filexxxx_xxxxxx.xxxpredictive
72Filexxxxxxx/xxxx-xxxxx-xxxxxx.xxxpredictive
73Filexxxxxxx/xxxx-xxxxx-xxxxxx.xxx?xxxxxx=xpredictive
74Filexxxxx.xxxpredictive
75Filexxxxx.xxpredictive
76Filexxxx.xpredictive
77Filexxxxxxxxxxxxxx.xxxpredictive
78Filexxxx_xxxxx.xxxpredictive
79Filexx/xxxx/xxxxx.xpredictive
80Filexx/xxxx/xxxxx.xpredictive
81Filexxxx/xxxx.xpredictive
82Filexxxxxxx/xxxxxx/xxx_xxxxxx/xxxxxxx/xxxxxx_xxxxxxx.xxxpredictive
83Filexxxxxx_xxxx_xxxxxx.xxxpredictive
84Filexxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictive
85Filexxxxxx_xx.xpredictive
86Filexxxxxxxxxxxx.xxxxx.xxxpredictive
87Filexxxxxx/xxxxx?xxxpredictive
88Filexxx/xxxxxx.xxxpredictive
89Filexxxxxxxxxxxxx.xxxpredictive
90Filexxxxx.xxxpredictive
91Filexxxxx.xxx/xxxxx/xxxxx/predictive
92Filexxxxx.xxx?x=/xxxx/xxxxxxxxpredictive
93Filexxxxxxxxxx/xxxxxxxx/xxxxxxxxxxx/xxx/xx/xxxxxxx.xxpredictive
94Filexx/xxxxxx.xxxxxxxxxxx.xxpredictive
95Filexxxxxxxxxxxxx/xxxxx.xxxpredictive
96Filexxxxxxxxx/xxxx_xxxxxxx.xxx.xxxpredictive
97Filexxxx/xxxxxxx/xxxxxxxx.xxxx.xxxpredictive
98Filexxxxxxx.xxxpredictive
99Filexxxxx.xxxpredictive
100Filexxxxx.xxxpredictive
101Filexxxxx_xxxx.xxxpredictive
102Filexxxxxx/xxxxx.xxxpredictive
103Filexxxx_xxx.xpredictive
104Filexxx_xx/xxx_xx_xxxxxx.xpredictive
105Filexxxx-xxx.xxpredictive
106Filexxxpredictive
107Filexxxxxx-xxxxxxxxxxx.xxxpredictive
108Filexxxxxxx/xxxxxxxxxx/xxx.xxxpredictive
109Filexxxxxxx.xxxpredictive
110Filexxxxx-xxxx.xpredictive
111Filexxxxxxx/xxxx/*predictive
112Filexxxxxxxx.xxxpredictive
113Filexxxxxxxxxxxxxxxxxx.xxxxpredictive
114Filexxxxxxxx.xxxpredictive
115Filexxxxxxxx.xxxpredictive
116Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictive
117Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictive
118Filexxxxxx_xxxxxx.xxxpredictive
119Filexxxxxxx.xxxpredictive
120Filexxxxxx/xxx.xxxpredictive
121Filexxxxxxxx.xxxxpredictive
122Filexxxx-xxxx.xpredictive
123Filexxx.xxpredictive
124Filexxx/xxxxxxx.xpredictive
125Filexxxxx_xxxx.xxxpredictive
126Filexxxxxxxx.xxxpredictive
127Filexxxxxx.xxpredictive
128Filexxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxxpredictive
129Filexxxxxxxx.xxxxpredictive
130Filexxxx-xxxxxxxx.xxxpredictive
131Filexxxxxxx.xpredictive
132Filexxxxxxxxx.xxxpredictive
133Filexxxxxxxxx.xxxpredictive
134Filexxxx/xxxxxx.xpredictive
135Filexxxxx/xxxxx.xxpredictive
136Filexxxxxxxx/xxxxxx_xxxxxxxpredictive
137Filexxx/xxxxxx.xxxpredictive
138Filexxxxxx.xxxpredictive
139Filexxxxxx.xpredictive
140Filexxxxxxxpredictive
141File~/xxxxx/xxxxxx/xxxxx-xxxxxxxxx-xxxxx.xxxpredictive
142Library/xxxxxxxxxxx.xxxpredictive
143Library/xxx/xxx/xxxx/xxxx.xxxpredictive
144Libraryxxxxxx/xxxxxxx/xxx/xxx/xxxxx/xxxxxx/xxxxxxxxx.xxxpredictive
145Libraryxxxxxxxxxxxxxx.xxxpredictive
146Libraryxxxxxx.xxpredictive
147Libraryxxxxxx.xxxxx.xxxxxxxxpredictive
148Argument$xxx_xxxx_xxxx)predictive
149Argumentxxxxxxxxxx/xxxxxxx/xxx/xxxx/xxxxxxxx/xxxxxxxxxxxxxxxpredictive
150Argumentxxx_xxxx_xx/xxx_xxxx_xxxxxpredictive
151Argumentxxxxpredictive
152Argumentxxxxxxxxxxxxxxpredictive
153Argumentxxxxxxxxpredictive
154Argumentxxxxxpredictive
155Argumentxxxxxxxxxxxxpredictive
156Argumentxxxpredictive
157Argumentxxxpredictive
158Argumentxxx_xxxxxxpredictive
159Argumentxxxxxpredictive
160Argumentxxxxxxx[x][xxxx]predictive
161Argumentxxxxxxxpredictive
162Argumentxxxxpredictive
163Argumentxxxxxxxxxxpredictive
164Argumentxxxxxxpredictive
165Argumentxxxxxxxxxxxxpredictive
166Argumentxxxxxpredictive
167Argumentxxxxx/xxxxxxxxpredictive
168Argumentxxxxxxpredictive
169Argumentxxxxxpredictive
170Argumentxxxxxxxxpredictive
171Argumentxxxxxxxpredictive
172Argumentxxxxxxxxpredictive
173Argumentxxxxxxxxxxpredictive
174Argumentxxxxxx[xxxxx][xxxxx][x][xxxx]predictive
175Argumentxxxxx xxxx/xxxx xxxxpredictive
176Argumentxxxxx/xxxxx/xxxxx/xxxxxxxpredictive
177Argumentxxxxxxxxpredictive
178Argumentxxxxxpredictive
179Argumentxxxxxpredictive
180Argumentxxxxxpredictive
181Argumentxxxxxxxxpredictive
182Argumentxxxxxxxxpredictive
183Argumentxxpredictive
184Argumentxxpredictive
185Argumentxxxxxxxxxpredictive
186Argumentxxxxxxxxxpredictive
187Argumentxxxxx_xxxxpredictive
188Argumentxxpredictive
189Argumentxxxxxxxxxpredictive
190Argumentxxxxxxpredictive
191Argumentxxxx_xxpredictive
192Argumentxxxxxxxxxpredictive
193Argumentxxxx xxxxxxpredictive
194Argumentxxxxxpredictive
195Argumentxxxx_xxxxxxxx/xxxxxx_xxxxxxxx/xxxxxx_xxxxxxxxpredictive
196Argumentxxxxpredictive
197Argumentxxxxxxxxxxpredictive
198Argumentxxxxpredictive
199Argumentxxxxxxpredictive
200Argumentxxxxxxxxpredictive
201Argumentxxxxpredictive
202Argumentxxxxx-xxxxxpredictive
203Argumentxxxxxxxxxxxpredictive
204Argumentxxxx_xxxxpredictive
205Argumentxxxxxxpredictive
206Argumentxxxxxxxx_xxxxxxx_xxxxxxx/xxxxxxxx_xxxxxx_xxxxxxxpredictive
207Argumentxxxxxxpredictive
208Argumentxxxx_xxxxxxxxpredictive
209Argumentxxxpredictive
210Argumentxxxxxxxxxxxpredictive
211Argumentxxxxxxxxxpredictive
212Argumentxxxpredictive
213Argumentxxxxpredictive
214Argumentxxxx-xxxxxpredictive
215Argumentxxxxxxxxpredictive
216Argumentxxxx_xxpredictive
217Argumentxxx_xxxpredictive
218Input Value../../../../../../../../../xxx/x.xxxpredictive
219Input Valuexxxxxx_xxxxxxxxpredictive
220Network Portxxx/xx (xxx)predictive
221Network Portxxx/xxxxpredictive
222Network Portxxx/xxxxpredictive
223Network Portxxx/xxxxxpredictive

参考 (29)

The following list contains external sources which discuss the actor and the associated activities:

Samples (5)

The following list contains associated samples:

Interested in the pricing of exploits?

See the underground prices here!