APT32 Analysis

IOB - Indicator of Behavior (582)

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Lang

en	466
zh	39
it	39
fr	18
de	6

Country

us	423
cn	102
vn	18
tr	11
ru	4

Actors

APT32	16
OceanLotus	9
StrikeSuit Gif	5
APT28	4
Patchwork	2

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

Not Defined	216
Smartphone Operating System	40
Content Management System	32
Operating System	30
Router Operating System	20

Vendor

Not Defined	128
Apple	46
Google	24
Apache	14
Microsoft	14

Product

Google Android	18
Apple iOS	18
Linux Kernel	14
Apple macOS	12
Apple iPadOS	12

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.04	0.04187	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.63	0.04187	CVE-2010-0966
3	Google Chrome V8 Remote Code Execution	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00	0.77051	CVE-2020-16040
4	Apache PDFbox XML Parser xml external entity reference	7.8	7.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.02537	CVE-2016-2175
5	Google Android SimpleDecodingSource.cpp doRead privileges management	9.8	9.6	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00	0.01156	CVE-2021-39623
6	D-Link DCS-2530L/DCS-2670L ddns_enc.cgi command injection	7.5	7.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.05	0.02055	CVE-2020-25079
7	Gempar Script Toko Online shop_display_products.php sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.08	0.00986	CVE-2009-0296
8	Puppet Agent SSL Certificate Valu certificate validation	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00885	CVE-2018-11751
9	Norton Password Manager origin validation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00885	CVE-2019-18381
10	Facebook osquery Configuration extensions.load link following	7.7	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00885	CVE-2019-3567
11	OpenSSH Authentication Username information disclosure	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.28	0.49183	CVE-2016-6210
12	TP-Link AC1750 NetUSB.ko integer overflow	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01	0.01036	CVE-2022-24354
13	Pallets Werkzeug Windows SharedDataMiddleware path traversal	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.76925	CVE-2019-14322
14	Peplink Balance Web Admin connector.php information disclosure	5.9	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06	0.00885	CVE-2020-24246
15	Tenda AC11 POST Request setmac stack-based overflow	7.6	7.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.01086	CVE-2021-31755
16	Apple macOS Kernel type confusion	7.8	7.5	$5k-$25k	$0-$5k	High	Official Fix	0.02	0.01889	CVE-2020-27932
17	Apple tvOS LaunchServices sandbox	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01	0.01034	CVE-2021-30677
18	Zyxel USG/USG Flex/Zywall/ATP/VPN Web-based Management Interface improper authentication	7.3	7.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.04	0.01055	CVE-2021-35029
19	Fortinet FortiWeb Management Interface os command injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.10855	CVE-2021-22123
20	Apple iOS/iPadOS FontParser memory corruption	6.3	6.0	$100k and more	$25k-$100k	Proof-of-Concept	Official Fix	0.08	0.01889	CVE-2020-27930

Campaigns (2)

These are the campaigns that can be associated with the actor:

Cobalt Kitty
OceanLotus

IOC - Indicator of Compromise (60)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Type	Confidence
1	23.227.196.126	23-227-196-126.static.hvvc.us	APT32	Cobalt Kitty	verified	High
2	23.227.196.210	23-227-196-210.static.hvvc.us	APT32		verified	High
3	23.227.199.121	23-227-199-121.static.hvvc.us	APT32	Cobalt Kitty	verified	High
4	27.102.70.211		APT32	Cobalt Kitty	verified	High
5	37.59.198.130		APT32	OceanLotus	verified	High
6	37.59.198.131		APT32	OceanLotus	verified	High
7	45.32.100.179	45.32.100.179.vultr.com	APT32	OceanLotus	verified	Medium
8	45.32.105.45		APT32	OceanLotus	verified	High
9	45.32.114.49	45.32.114.49.vultr.com	APT32	OceanLotus	verified	Medium
10	45.76.147.201	45.76.147.201.vultr.com	APT32	OceanLotus	verified	Medium
11	45.76.179.28	45.76.179.28.vultr.com	APT32	OceanLotus	verified	Medium
12	45.76.179.151	45.76.179.151.vultr.com	APT32	OceanLotus	verified	Medium
13	45.77.39.101	45.77.39.101.vultr.com	APT32	OceanLotus	verified	Medium
14	45.114.117.137		APT32	Cobalt Kitty	verified	High
15	45.114.117.164	folien.reisnart.com	APT32	OceanLotus	verified	High
16	64.62.174.9	agent2.jenkins.aoindustries.com	APT32	OceanLotus	verified	High
17	64.62.174.16	unassigned16.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
18	64.62.174.17	unassigned17.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
19	64.62.174.21	unassigned21.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
20	64.62.174.41	dev1.plant-orbit.com	APT32	OceanLotus	verified	High
21	64.62.174.99	unassigned99.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
22	64.62.174.145	unassigned145.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
23	64.62.174.146	unassigned146.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
24	79.143.87.174		APT32	OceanLotus	verified	High
25	80.255.3.87		APT32		verified	High
26	89.33.64.207		APT32	OceanLotus	verified	High
27	89.33.64.232	mypicsfromplane.com	APT32	OceanLotus	verified	High
28	103.28.44.112	103028044112.hkserverdomain.com	APT32	OceanLotus	verified	High
29	103.28.44.115	103028044115.hkserverdomain.com	APT32	OceanLotus	verified	High
30	103.41.177.33		APT32	Cobalt Kitty	verified	High
31	103.53.197.202	sg06.dewaweb.com	APT32		verified	High
32	104.24.118.185		APT32	Cobalt Kitty	verified	High
33	104.24.119.185		APT32	Cobalt Kitty	verified	High
34	104.27.166.79		APT32	Cobalt Kitty	verified	High
35	104.27.167.79		APT32	Cobalt Kitty	verified	High
36	104.237.218.67	usgreatly.com	APT32	Cobalt Kitty	verified	High
37	104.237.218.70	70.utdanne.104.xandien.nl	APT32		verified	High
38	104.237.218.72	emudd.pointumetwe.com	APT32		verified	High
39	108.170.31.69		APT32	Cobalt Kitty	verified	High
40	110.10.179.65		APT32	Cobalt Kitty	verified	High
41	128.199.90.216		APT32	OceanLotus	verified	High
42	128.199.227.80	426977.cloudwaysapps.com	APT32	OceanLotus	verified	High
43	138.197.236.215		APT32	OceanLotus	verified	High
44	139.59.217.207		APT32	OceanLotus	verified	High
45	139.59.220.10		APT32	OceanLotus	verified	High
46	139.59.220.12		APT32	OceanLotus	verified	High
47	139.59.223.191		APT32	OceanLotus	verified	High
48	176.107.176.6	176.107.176.6.ptr	APT32	Cobalt Kitty	verified	High
49	176.107.177.216	176.107.177.216.deltahost-ptr	APT32	Cobalt Kitty	verified	High
50	176.223.111.116		APT32	Cobalt Kitty	verified	High
51	184.95.51.179	pen179.penflexhost.com	APT32	Cobalt Kitty	verified	High
52	184.95.51.181	mx.earthgeneration.org	APT32	Cobalt Kitty	verified	High
53	184.95.51.190	laudantiumkvgqi.finewonu.club	APT32	Cobalt Kitty	verified	High
54	185.157.79.3	185.157.79.3.deltahost-ptr	APT32		verified	High
55	188.166.219.18	696006.cloudwaysapps.com	APT32	OceanLotus	verified	High
56	192.121.176.148		APT32	Cobalt Kitty	verified	High
57	193.169.245.78	193.169.245.78.deltahost-ptr	APT32		verified	High
58	193.169.245.137	n116.deltahost.com.ua	APT32		verified	High
59	203.114.75.22		APT32	OceanLotus	verified	High
60	203.114.75.73		APT32	OceanLotus	verified	High

TTP - Tactics, Techniques, Procedures (22)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-21, CWE-22, CWE-23	Pathname Traversal	predictive	High
2	T1040	CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CWE-74	Injection	predictive	High
4	T1059	CWE-94	Cross Site Scripting	predictive	High
5	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
6	T1068	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
7	T1110.001	CWE-798	Improper Restriction of Excessive Authentication Attempts	predictive	High
8	T1202	CWE-77, CWE-78	Command Injection	predictive	High
9	T1204.001	CWE-601	Open Redirect	predictive	High
10	T1211	CWE-254	7PK Security Features	predictive	High
11	T1222	CWE-275, CWE-276	Permission Issues	predictive	High
12	T1505	CWE-89	SQL Injection	predictive	High
13	T1548.002	CWE-285	Improper Authorization	predictive	High
14	T1552	CWE-255, CWE-522	ASP.NET Misconfiguration: Password in Configuration File	predictive	High
15	T1574	CWE-426, CWE-427	Untrusted Search Path	predictive	High
16	T1587.003	CWE-295	Improper Certificate Validation	predictive	High
17	T1588.001	CWE-912	Backdoor	predictive	High
18	T1592	CWE-200, CWE-209	Configuration	predictive	High
19	T1592.004	CWE-16	Configuration	predictive	High
20	T1600	CWE-310, CWE-311, CWE-326, CWE-327	J2EE Misconfiguration: Data Transmission Without Encryption	predictive	High
21	T1608.002	CWE-434	Unrestricted Upload	predictive	High
22	T1611	CWE-265	Containment Errors	predictive	High

IOA - Indicator of Attack (215)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/	predictive	Low
2	File	/cgi-bin/cgiServer.exx	predictive	High
3	File	/cgi-bin/login_action.cgi	predictive	High
4	File	/cgi-bin/nobody/Search.cgi	predictive	High
5	File	/cgi-bin/webviewer_login_page	predictive	High
6	File	/dev/sg0	predictive	Medium
7	File	/event/runquery.do	predictive	High
8	File	/filemanager/php/connector.php	predictive	High
9	File	/forum/away.php	predictive	High
10	File	/goform/setmac	predictive	High
11	File	/log_download.cgi	predictive	High
12	File	/manager?action=getlogcat	predictive	High
13	File	/mgmt/tm/util/bash	predictive	High
14	File	/pages/systemcall.php?command={COMMAND}	predictive	High
15	File	/password.html	predictive	High
16	File	/system/ws/v11/ss/email	predictive	High
17	File	/uncpath/	predictive	Medium
18	File	/upload	predictive	Low
19	File	add_vhost.php	predictive	High
20	File	admin/images.aspx	predictive	High
21	File	admin/index.php	predictive	High
22	File	adv2.php?action=modify	predictive	High
23	File	agent.cfg	predictive	Medium
24	File	arch/x86/include/asm/fpu/internal.h	predictive	High
25	File	asm/float.c	predictive	Medium
26	File	asm/nasm.c	predictive	Medium
27	File	auth.php	predictive	Medium
28	File	backup.cgi	predictive	Medium
29	File	binder.c	predictive	Medium
30	File	bitfield.c	predictive	Medium
31	File	blob.cpp	predictive	Medium
32	File	books.php	predictive	Medium
33	File	c.php	predictive	Low
34	File	cgi-bin/	predictive	Medium
35	File	cgi-bin/ddns_enc.cgi	predictive	High
36	File	cgi-bin/luci/admin/network/firewall/rules	predictive	High
37	File	cgi-bin/MANGA/admin.cgi	predictive	High
38	File	cli.conf	predictive	Medium
39	File	coders/png.c	predictive	Medium
40	File	coders/tiff.c	predictive	High
41	File	coffgen.c	predictive	Medium
42	File	config.xml	predictive	Medium
43	File	connector.minimal.php	predictive	High
44	File	data/gbconfiguration.dat	predictive	High
45	File	db.php	predictive	Low
46	File	detail.php	predictive	Medium
47	File	devtools.sh	predictive	Medium
48	File	domain/section/markdown/markdown.go	predictive	High
49	File	drivers/gpu/drm/udl/udl_fb.c	predictive	High
50	File	drivers/scsi/sr_ioctl.c	predictive	High
51	File	drivers/usb/misc/iowarrior.c	predictive	High
52	File	ebmlstring.c	predictive	Medium
53	File	elf.c	predictive	Low
54	File	email.php	predictive	Medium
55	File	events-manager.js	predictive	High
56	File	ExceptionHandler.php	predictive	High
57	File	extensions.load	predictive	High
58	File	FlexPaperViewer.swf	predictive	High
59	File	folder_view.php	predictive	High
60	File	FortiClientOnlineInstaller.exe	predictive	High
61	File	framework/core/subsystems/expRouter.php	predictive	High
62	File	fs/userfaultfd.c	predictive	High
63	File	function.c	predictive	Medium
64	File	functions.php	predictive	High
65	File	functions_mod_user.php	predictive	High
66	File	getRemoteImage.php	predictive	High
67	File	get_set.ccp	predictive	Medium
68	File	gki_buffer.cc	predictive	High
69	File	handle_load_config.php	predictive	High
70	File	hh.exe	predictive	Low
71	File	image_upload.php	predictive	High
72	File	imap/lmtp_sieve.c	predictive	High
73	File	inc/config.php	predictive	High
74	File	inc/filebrowser/browser.php	predictive	High
75	File	include/findusers.php	predictive	High
76	File	includes/head.inc.php	predictive	High
77	File	index.php	predictive	Medium
78	File	init.inc.php	predictive	Medium
79	File	intervalCheck.jsp	predictive	High
80	File	iptc.c	predictive	Low
81	File	ItemReview.php	predictive	High
82	File	items.c	predictive	Low
83	File	items.queries.php	predictive	High
84	File	item_show.php	predictive	High
85	File	JBIG2Stream.cc	predictive	High
86	File	jeecgFormDemoController.do?commonUpload	predictive	High
87	File	jfinal_cms/admin/filemanager/list	predictive	High
88	File	jpgraph.php	predictive	Medium
89	File	kbdint.c	predictive	Medium
90	File	kernel/events/core.c	predictive	High
91	File	kernel/exit.c	predictive	High
92	File	kernel/trace/trace_events_filter.c	predictive	High
93	File	launchd	predictive	Low
94	File	libnvmmlite_video.so	predictive	High
95	File	libr/asm/asm.c	predictive	High
96	File	main/scala/authentikat/jwt/JsonWebToken.scala	predictive	High
97	File	misc/apr_rmm.c	predictive	High
98	File	mm/mempolicy.c	predictive	High
99	File	mm/oom_kill.c	predictive	High
100	File	model/__show_info.php	predictive	High
101	File	modules/m_sasl.c	predictive	High
102	File	NativeNfcManager.cpp	predictive	High
103	File	net/ipv4/datagram.c	predictive	High
104	File	net/ipv4/inet_connection_sock.c	predictive	High
105	File	net/packet/af_packet.c	predictive	High
106	File	openjp2/pi.c	predictive	Medium
107	File	plugins\meta_engine\libfolder_plugin.dll	predictive	High
108	File	prod.php	predictive	Medium
109	File	prog/htmlviewer.c	predictive	High
110	File	proxy.cgi	predictive	Medium
111	File	public/index.php/home	predictive	High
112	File	public/index.php/home/membersnsfriend/findlist.html	predictive	High
113	File	QueryComponentRendererValue!Default.jspa	predictive	High
114	File	RecentLocationApps.java	predictive	High
115	File	register/check/username?username	predictive	High
116	File	registration_detailed.inc.php	predictive	High
117	File	secure_img_render.php	predictive	High
118	File	setenv.sh	predictive	Medium
119	File	setup/index.php	predictive	High
120	File	shop.cgi	predictive	Medium
121	File	shop_display_products.php	predictive	High
122	File	showcat.php	predictive	Medium
123	File	SimpleDecodingSource.cpp	predictive	High
124	File	software-description.php	predictive	High
125	File	svox_ssml_parser.cpp	predictive	High
126	File	SystemEvent.jsp	predictive	High
127	File	system_log.cgi	predictive	High
128	File	tls1.c	predictive	Low
129	File	ui/artifact/upload	predictive	High
130	File	upgrade_handle.php	predictive	High
131	File	view/ProductsView.php	predictive	High
132	File	WealthT24/GetImage	predictive	High
133	File	welcome.php	predictive	Medium
134	File	www/content/lessons/"lesson	predictive	High
135	Library	AeXNSPkgDLLib.dll	predictive	High
136	Library	ATIDXX64.DLL	predictive	Medium
137	Library	ENCDEC.DLL	predictive	Medium
138	Library	fs/ncpfs/ncplib_kernel.c	predictive	High
139	Library	igcore19d.dll	predictive	High
140	Library	Lib/DocXMLRPCServer.py	predictive	High
141	Library	lib/MongoLite/Database.php	predictive	High
142	Library	lib/rrd.php	predictive	Medium
143	Library	Monitor_win7_x64.sys	predictive	High
144	Library	Monitor_x86.sys	predictive	High
145	Argument	$line	predictive	Low
146	Argument	%s	predictive	Low
147	Argument	agentid	predictive	Low
148	Argument	app	predictive	Low
149	Argument	AUTHENTICATE	predictive	Medium
150	Argument	basePath	predictive	Medium
151	Argument	bauth	predictive	Low
152	Argument	bookid	predictive	Low
153	Argument	cat	predictive	Low
154	Argument	catid	predictive	Low
155	Argument	cat_id	predictive	Low
156	Argument	ccp_act	predictive	Low
157	Argument	charset	predictive	Low
158	Argument	code_no	predictive	Low
159	Argument	configFile	predictive	Medium
160	Argument	content	predictive	Low
161	Argument	Content-Length	predictive	High
162	Argument	CPG_M_DIR	predictive	Medium
163	Argument	data3	predictive	Low
164	Argument	docDownloadPath/uploadLocation	predictive	High
165	Argument	err	predictive	Low
166	Argument	file	predictive	Low
167	Argument	filename	predictive	Medium
168	Argument	fromName/message	predictive	High
169	Argument	go	predictive	Low
170	Argument	groups	predictive	Low
171	Argument	id	predictive	Low
172	Argument	ipAddr	predictive	Low
173	Argument	IP address	predictive	Medium
174	Argument	item_id	predictive	Low
175	Argument	l/dl/del	predictive	Medium
176	Argument	layout	predictive	Low
177	Argument	mapTitle	predictive	Medium
178	Argument	mosConfig_absolute_path	predictive	High
179	Argument	name	predictive	Low
180	Argument	page	predictive	Low
181	Argument	password	predictive	Medium
182	Argument	Password	predictive	Medium
183	Argument	phpbb_root_path	predictive	High
184	Argument	priority	predictive	Medium
185	Argument	reason	predictive	Low
186	Argument	redirect	predictive	Medium
187	Argument	Referer	predictive	Low
188	Argument	referrer	predictive	Medium
189	Argument	resourceName	predictive	Medium
190	Argument	rootpath	predictive	Medium
191	Argument	sbp	predictive	Low
192	Argument	search	predictive	Low
193	Argument	searchid	predictive	Medium
194	Argument	sid	predictive	Low
195	Argument	site	predictive	Low
196	Argument	sms_content	predictive	Medium
197	Argument	src	predictive	Low
198	Argument	Swfile	predictive	Low
199	Argument	tpldir/filename/type/nid	predictive	High
200	Argument	upfile	predictive	Low
201	Argument	uploaddir	predictive	Medium
202	Argument	up_auto_log	predictive	Medium
203	Argument	url	predictive	Low
204	Argument	uselang	predictive	Low
205	Argument	wd	predictive	Low
206	Argument	_receivers	predictive	Medium
207	Input Value	%0a/%0d	predictive	Low
208	Input Value	./../../../	predictive	Medium
209	Input Value	1" onmouseover=prompt(947671) bad="	predictive	High
210	Input Value	</script><script>alert(1)</script>	predictive	High
211	Input Value	welc0me	predictive	Low
212	Input Value	\x3D../../../../etc/passwd	predictive	High
213	Network Port	8888	predictive	Low
214	Network Port	tcp/873	predictive	Low
215	Network Port	tcp/6200	predictive	Medium

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!