APT2 Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (102)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	72
zh	18
es	10
sv	2

Country

CN: China	92
FJ: Fiji	6
US: USA	2
KR: South Korea	2

Actors

APT2	4
United States of America	1

Activities

Interest

Timeline

Type

Not Defined	26
Operating System	10
Web Browser	8
Router Operating System	8
Firewall Software	6

Vendor

Not Defined	30
Cisco	6
Apple	6
Microsoft	6
Mozilla	4

Product

Mozilla Firefox	4
Cisco IOS XE	4
Microsoft Internet Explorer	4
SuperEnergy	2
Cisco Firepower System Software	2

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	Zoho ManageEngine Applications Manager Agent.java sql injection	7.5	7.2	$1k-$2k	$0-$1k	Not defined	Official fix		0.07394	0.04	CVE-2019-19650
2	Cisco ASA/Firepower Threat Defense RSA Key information exposure	6.2	6.2	$10k-$25k	$0-$1k	Not defined	Official fix		0.23852	0.00	CVE-2022-20866
3	TikiWiki tiki-register.php input validation	7.3	6.6	$2k-$5k	$0-$1k	Proof-of-Concept	Official fix		0.04277	0.50	CVE-2006-6168
4	Wireshark unxorFrame input validation	5.3	5.1	$2k-$5k	$0-$1k	Not defined	Official fix		0.01440	0.06	CVE-2011-3484
5	DokuWiki code injection	9.8	8.8	$2k-$5k	$0-$1k	Proof-of-Concept	Official fix		0.30702	0.05	CVE-2009-1960
6	Grafana/Grafana Enterprise Email authorization	5.0	5.0	$2k-$5k	$0-$1k	Not defined	Official fix		0.00229	0.06	CVE-2023-6152
7	Fortinet FortiOS FortiClient SSL_VPN Linux access control	7.8	7.8	$2k-$5k	$0-$1k	Not defined	Not defined		0.00000	0.00	CVE-2016-8497
8	Xpdf DCT Stream uninitialized resource	6.2	6.2	$0-$1k	$0-$1k	Not defined	Not defined		0.00034	0.00	CVE-2024-7868
9	Panabit Panalog sprog_upstatus.php sql injection	8.1	8.0	$2k-$5k	$0-$1k	Proof-of-Concept	Not defined		0.00144	0.02	CVE-2024-2014
10	Oracle MySQL Server Packaging information disclosure	7.5	7.3	$5k-$10k	$0-$1k	Not defined	Official fix		0.02052	0.02	CVE-2023-5363
11	Sun Solaris denial of service	6.2	6.2	$2k-$5k	$0-$1k	Not defined	Not defined		0.00049	0.03	CVE-2011-2259
12	Spring Boot Admins Notifier env code injection	7.5	7.4	$1k-$2k	$0-$1k	Not defined	Official fix	possible	0.38135	0.00	CVE-2022-46166
13	ASUS RT-AC51U Network Request cross site scripting	4.6	4.6	$0-$1k	$0-$1k	Not defined	Not defined		0.02562	0.00	CVE-2023-29772
14	Zoho ManageEngine Desktop Central HTTP Redirect information disclosure	3.5	3.4	$0-$1k	$0-$1k	Not defined	Official fix	possible	0.71155	0.08	CVE-2022-23779
15	Dropbear SSH dropbearconvert input validation	8.0	7.7	$2k-$5k	$0-$1k	Not defined	Official fix		0.01525	0.08	CVE-2016-7407
16	MediaTek MT6983 tinysys out-of-bounds write	5.4	5.3	$0-$1k	$0-$1k	Not defined	Official fix		0.00011	0.00	CVE-2023-20621
17	Router/Firewall Routing privileges management	7.3	7.1	$2k-$5k	$0-$1k	Not defined	Workaround		0.00489	0.05	CVE-1999-0510
18	Kibana Region Map cross site scripting	4.4	4.4	$1k-$2k	$0-$1k	Not defined	Official fix		0.00349	0.02	CVE-2019-7621
19	Apple Mac OS X Server Wiki Server cross site scripting	4.3	4.3	$5k-$10k	$0-$1k	Not defined	Not defined		0.00499	0.10	CVE-2009-2814

Campaigns (1)

These are the campaigns that can be associated with the actor:

Putter Panda

IOC - Indicator of Compromise (42)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	31.170.110.163	io.uu3.net	APT2	Putter Panda	01/01/2021	verified	Low
2	58.196.156.15		APT2	Putter Panda	01/01/2021	verified	Low
3	59.120.168.199	59-120-168-199.hinet-ip.hinet.net	APT2		12/20/2020	verified	Low
4	61.34.97.69		APT2		12/20/2020	verified	Low
5	61.74.190.14		APT2		12/20/2020	verified	Low
6	61.78.37.121		APT2		12/20/2020	verified	Low
7	61.78.75.96		APT2		12/20/2020	verified	Low
8	61.221.54.99	61-221-54-99.hinet-ip.hinet.net	APT2		12/20/2020	verified	Low
9	67.42.255.50	mail.provocc.org	APT2		12/20/2020	verified	Low
10	XXX.XX.XXX.XXX	xxxxxxx.xxxxxx.xx	Xxxx	Xxxxxx Xxxxx	01/01/2021	verified	Low
11	XXX.XXX.XXX.XXX		Xxxx		12/20/2020	verified	Low
12	XXX.XXX.XXX.XXX	xxxxxxx.xxxx.xxx.xxxxx.xxx	Xxxx		12/20/2020	verified	Very Low
13	XXX.XXX.XX.XXX	xxxxxxxx.xx.xxx.xxx.xx	Xxxx		12/20/2020	verified	Low
14	XXX.XXX.XX.X	xxxxxxxxxx.xx.xxx.xxx.xx	Xxxx		12/20/2020	verified	Low
15	XXX.XXX.XX.XXX	xx-xx-xxx.xx.xxxx.xxx.xx	Xxxx		12/20/2020	verified	Very Low
16	XXX.XXX.XXX.XX	xxxxxxx.xx.xxxx.xxx.xx	Xxxx		12/20/2020	verified	Very Low
17	XXX.XXX.XX.XX	xxxxxxxxx.xxxx.xxx.xx	Xxxx		12/20/2020	verified	Very Low
18	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxxx.xxx	Xxxx		12/20/2020	verified	Low
19	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxxxxxxxxxx.xxx	Xxxx		12/20/2020	verified	Very Low
20	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxxxxxxxxxx.xxx	Xxxx		12/20/2020	verified	Very Low
21	XXX.XXX.XXX.X		Xxxx		12/20/2020	verified	Low
22	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxxxxx.xxxxxxx.xxx	Xxxx		12/20/2020	verified	Low
23	XXX.XXX.XX.XXX	xxxx.xxxxxxxxx.xxxxxxx.xx.xx	Xxxx		12/20/2020	verified	Low
24	XXX.XX.XXX.XXX	xxxxxxxxxx.xxx	Xxxx		12/20/2020	verified	Low
25	XXX.XXX.XXX.XXX		Xxxx		12/20/2020	verified	Low
26	XXX.XXX.XX.XX		Xxxx		12/20/2020	verified	Low
27	XXX.X.XX.XX		Xxxx		12/20/2020	verified	Low
28	XXX.X.XX.XX		Xxxx		12/20/2020	verified	Low
29	XXX.XX.XXX.XXX		Xxxx		12/20/2020	verified	Low
30	XXX.XXX.XX.XX	xxxxx-xxx-xx-xx.xxxx.xxxxxx.xxxx.xxx.xx	Xxxx		12/20/2020	verified	Low
31	XXX.XX.XX.XX	xxx-xx-xx-xx.xxxxx-xx.xxxxx.xxx	Xxxx		12/20/2020	verified	Low
32	XXX.XX.XX.XXX	xxx-xx-xx-xxx.xxxxx-xx.xxxxx.xxx	Xxxx		12/20/2020	verified	Low
33	XXX.XX.XXX.XX		Xxxx		12/20/2020	verified	Low
34	XXX.XXX.XXX.XXX	xxxx.xxxxxxxxx.xx	Xxxx		12/20/2020	verified	Low
35	XXX.XXX.XXX.XXX	xxxxxxx.xxxxxxxxx.xxx.xx	Xxxx	Xxxxxx Xxxxx	01/01/2021	verified	Very Low
36	XXX.XXX.XX.XX		Xxxx		12/20/2020	verified	Low
37	XXX.XXX.XX.XXX		Xxxx		12/20/2020	verified	Low
38	XXX.XXX.XX.XX		Xxxx		12/20/2020	verified	Low
39	XXX.XXX.XX.XX		Xxxx		12/20/2020	verified	Low
40	XXX.XXX.XX.XXX		Xxxx		12/20/2020	verified	Low
41	XXX.XXX.XXX.X		Xxxx		12/20/2020	verified	Low
42	XXX.XXX.XX.XXX		Xxxx		12/20/2020	verified	Low

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX.XXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxx Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX		CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX		CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
7	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
9	TXXXX		CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
10	TXXXX.XXX		CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High

IOA - Indicator of Attack (36)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/blog/blogcategory/add/?_to_field=id&_popup=1	predictive	High
2	File	/bin/boa	predictive	Medium
3	File	/DOWN/FIRMWAREUPDATE/ROM1	predictive	High
4	File	/env	predictive	Low
5	File	/Maintain/sprog_upstatus.php	predictive	High
6	File	xxxxx/xxxxx/xxxxxxxxx.xxxx	predictive	High
7	File	xxxxxxxx.xxx	predictive	Medium
8	File	xxxxxx-xxxxxx.xxxx	predictive	High
9	File	xxxxxxxxxx.xxx	predictive	High
10	File	xxxx/xxxxxxxxxxxx.xxx	predictive	High
11	File	xxxxxxx/xxx/xxxxxxxxx/xxxxx.x	predictive	High
12	File	xxxxxxxx/xxxx/xxxxxxxx.xxx	predictive	High
13	File	xxxxxxxx/xxxx.xxx.xxx	predictive	High
14	File	xxxxx.xxx	predictive	Medium
15	File	xxx_xxxxxxxx.x	predictive	High
16	File	xxxxxx/xxxxx.xxx	predictive	High
17	File	xxxx-xxxxxxxx.xxx	predictive	High
18	File	xxxxxxx_xxx.xxx	predictive	High
19	Library	xxx_xxxxx_xxxxxxx	predictive	High
20	Library	xxxxxxxx.xxx	predictive	Medium
21	Argument	xxxxxxx	predictive	Low
22	Argument	xxxxxxxxxxxxx	predictive	High
23	Argument	xxxxxx_xxxxxxx[xxxx][xxxxxxx][]	predictive	High
24	Argument	xxxxxxx-xxxxxx	predictive	High
25	Argument	xxx_xxxx	predictive	Medium
26	Argument	xxxxxxxx	predictive	Medium
27	Argument	xx	predictive	Low
28	Argument	xxxxx_xx	predictive	Medium
29	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	High
30	Argument	xxxx_xxxxxx	predictive	Medium
31	Argument	xxxxxx	predictive	Low
32	Argument	xxxxxxx	predictive	Low
33	Argument	xxxxx	predictive	Low
34	Argument	xxxx	predictive	Low
35	Argument	xxxxxxxx	predictive	Medium
36	Pattern	xxxxxxx-xxxxxx\|xx\|	predictive	High

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!