APT32 Analysis

Activities

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Lang

en	450
it	39
zh	29
fr	17
de	6

Country

us	414
cn	85
vn	18
tr	11
id	3

Actors

APT32	343
APT28	109
OceanLotus	99

Activities

Interest

Timeline

Type

Not Defined	205
Operating System	40
Smartphone Operating System	39
Content Management System	21
Router Operating System	18

The moderation team is working with the threat intelligence team to categorize software that is affected by security vulnerabilities. This helps to illustrate the assignment of these categories to determine the most affected software types.

Vendor

Not Defined	130
Apple	46
Google	28
Microsoft	23
Linux	18

Identifying all affected vendors is a good starting point for an overview. This makes it possible to determine an homogeneous landscape or the most important hotspots in heterogeneous landscapes.

Product

Google Android	22
Linux Kernel	18
Apple iOS	14
Apple macOS	12
Microsoft Windows	7

Grouping vulnerabilities by products helps to get an overview. This makes it possible to determine an homogeneous landscape or the most important hotspots in heterogeneous landscapes.

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$10k-$25k	$0-$1k	High	Workaround	0.05	CVE-2007-1192
2	Google Chrome V8 Remote Code Execution	6.3	6.0	$50k-$100k	$10k-$25k	Not Defined	Official Fix	0.03	CVE-2020-16040
3	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$2k-$5k	$0-$1k	Proof-of-Concept	Official Fix	0.40	CVE-2010-0966
4	Apache PDFbox XML Parser xml external entity reference	7.8	7.5	$10k-$25k	$0-$1k	Not Defined	Official Fix	0.00	CVE-2016-2175
5	Google Android SimpleDecodingSource.cpp doRead privileges management	9.8	9.6	$50k-$100k	$25k-$50k	Not Defined	Official Fix	0.05	CVE-2021-39623
6	D-Link DCS-2530L/DCS-2670L ddns_enc.cgi command injection	7.5	7.5	$10k-$25k	$10k-$25k	Not Defined	Not Defined	0.03	CVE-2020-25079
7	Gempar Script Toko Online shop_display_products.php sql injection	7.3	6.9	$2k-$5k	$0-$1k	Proof-of-Concept	Not Defined	0.03	CVE-2009-0296
8	Puppet Agent SSL Certificate Valu certificate validation	5.5	5.3	$1k-$2k	$0-$1k	Not Defined	Official Fix	0.04	CVE-2018-11751
9	Norton Password Manager origin validation	6.3	6.0	$2k-$5k	$0-$1k	Not Defined	Official Fix	0.04	CVE-2019-18381
10	Facebook osquery Configuration extensions.load link following	7.7	7.3	$10k-$25k	$1k-$2k	Not Defined	Official Fix	0.04	CVE-2019-3567
11	TP-Link AC1750 NetUSB.ko integer overflow	8.8	8.6	$2k-$5k	$0-$1k	Not Defined	Official Fix	0.03	CVE-2022-24354
12	Pallets Werkzeug Windows SharedDataMiddleware path traversal	7.5	7.2	$2k-$5k	$0-$1k	Not Defined	Official Fix	0.00	CVE-2019-14322
13	Peplink Balance Web Admin connector.php information disclosure	5.9	5.6	$1k-$2k	$0-$1k	Not Defined	Official Fix	0.05	CVE-2020-24246
14	Tenda AC11 POST Request setmac stack-based overflow	7.6	7.6	$2k-$5k	$1k-$2k	Not Defined	Not Defined	0.06	CVE-2021-31755
15	Apple macOS Kernel type confusion	7.8	7.5	$10k-$25k	$2k-$5k	High	Official Fix	0.03	CVE-2020-27932
16	Apple tvOS LaunchServices sandbox	5.3	5.1	$2k-$5k	$0-$1k	Not Defined	Official Fix	0.05	CVE-2021-30677
17	Zyxel USG/USG Flex/Zywall/ATP/VPN Web-based Management Interface improper authentication	7.3	7.3	$10k-$25k	$5k-$10k	Not Defined	Not Defined	0.07	CVE-2021-35029
18	Fortinet FortiWeb Management Interface os command injection	6.3	6.3	$2k-$5k	$1k-$2k	Not Defined	Not Defined	0.03	CVE-2021-22123
19	Apple iOS/iPadOS FontParser memory corruption	6.3	6.0	$100k and more	$25k-$50k	Proof-of-Concept	Official Fix	0.00	CVE-2020-27930
20	Yaws Web Server CGI os command injection	8.5	8.5	$2k-$5k	$1k-$2k	Not Defined	Not Defined	0.04	CVE-2020-24916

Campaigns (2)

These are the campaigns that can be associated with the actor:

Cobalt Kitty
OceanLotus

IOC - Indicator of Compromise (60)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Type	Confidence
1	23.227.196.126	23-227-196-126.static.hvvc.us	APT32	Cobalt Kitty	verified	High
2	23.227.196.210	23-227-196-210.static.hvvc.us	APT32		verified	High
3	23.227.199.121	23-227-199-121.static.hvvc.us	APT32	Cobalt Kitty	verified	High
4	27.102.70.211		APT32	Cobalt Kitty	verified	High
5	37.59.198.130		APT32	OceanLotus	verified	High
6	37.59.198.131		APT32	OceanLotus	verified	High
7	45.32.100.179	45.32.100.179.vultr.com	APT32	OceanLotus	verified	Medium
8	45.32.105.45		APT32	OceanLotus	verified	High
9	45.32.114.49	45.32.114.49.vultr.com	APT32	OceanLotus	verified	Medium
10	45.76.147.201	45.76.147.201.vultr.com	APT32	OceanLotus	verified	Medium
11	45.76.179.28	45.76.179.28.vultr.com	APT32	OceanLotus	verified	Medium
12	45.76.179.151	45.76.179.151.vultr.com	APT32	OceanLotus	verified	Medium
13	45.77.39.101	45.77.39.101.vultr.com	APT32	OceanLotus	verified	Medium
14	45.114.117.137		APT32	Cobalt Kitty	verified	High
15	45.114.117.164	folien.reisnart.com	APT32	OceanLotus	verified	High
16	64.62.174.9	agent2.jenkins.aoindustries.com	APT32	OceanLotus	verified	High
17	64.62.174.16	unassigned16.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
18	64.62.174.17	unassigned17.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
19	64.62.174.21	unassigned21.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
20	64.62.174.41	dev1.plant-orbit.com	APT32	OceanLotus	verified	High
21	64.62.174.99	unassigned99.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
22	64.62.174.145	unassigned145.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
23	64.62.174.146	unassigned146.net2.fc.aoindustries.com	APT32	OceanLotus	verified	High
24	79.143.87.174		APT32	OceanLotus	verified	High
25	80.255.3.87		APT32		verified	High
26	89.33.64.207		APT32	OceanLotus	verified	High
27	89.33.64.232	mypicsfromplane.com	APT32	OceanLotus	verified	High
28	103.28.44.112	103028044112.hkserverdomain.com	APT32	OceanLotus	verified	High
29	103.28.44.115	103028044115.hkserverdomain.com	APT32	OceanLotus	verified	High
30	103.41.177.33		APT32	Cobalt Kitty	verified	High
31	103.53.197.202	sg06.dewaweb.com	APT32		verified	High
32	104.24.118.185		APT32	Cobalt Kitty	verified	High
33	104.24.119.185		APT32	Cobalt Kitty	verified	High
34	104.27.166.79		APT32	Cobalt Kitty	verified	High
35	104.27.167.79		APT32	Cobalt Kitty	verified	High
36	104.237.218.67	usgreatly.com	APT32	Cobalt Kitty	verified	High
37	104.237.218.70	70.utdanne.104.xandien.nl	APT32		verified	High
38	104.237.218.72	emudd.pointumetwe.com	APT32		verified	High
39	108.170.31.69		APT32	Cobalt Kitty	verified	High
40	110.10.179.65		APT32	Cobalt Kitty	verified	High
41	128.199.90.216		APT32	OceanLotus	verified	High
42	128.199.227.80	426977.cloudwaysapps.com	APT32	OceanLotus	verified	High
43	138.197.236.215		APT32	OceanLotus	verified	High
44	139.59.217.207		APT32	OceanLotus	verified	High
45	139.59.220.10		APT32	OceanLotus	verified	High
46	139.59.220.12		APT32	OceanLotus	verified	High
47	139.59.223.191		APT32	OceanLotus	verified	High
48	176.107.176.6	176.107.176.6.ptr	APT32	Cobalt Kitty	verified	High
49	176.107.177.216	176.107.177.216.deltahost-ptr	APT32	Cobalt Kitty	verified	High
50	176.223.111.116		APT32	Cobalt Kitty	verified	High
51	184.95.51.179	pen179.penflexhost.com	APT32	Cobalt Kitty	verified	High
52	184.95.51.181	mx.earthgeneration.org	APT32	Cobalt Kitty	verified	High
53	184.95.51.190	laudantiumkvgqi.finewonu.club	APT32	Cobalt Kitty	verified	High
54	185.157.79.3	185.157.79.3.deltahost-ptr	APT32		verified	High
55	188.166.219.18	696006.cloudwaysapps.com	APT32	OceanLotus	verified	High
56	192.121.176.148		APT32	Cobalt Kitty	verified	High
57	193.169.245.78	193.169.245.78.deltahost-ptr	APT32		verified	High
58	193.169.245.137	n116.deltahost.com.ua	APT32		verified	High
59	203.114.75.22		APT32	OceanLotus	verified	High
60	203.114.75.73		APT32	OceanLotus	verified	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
2	T1068	CWE-264, CWE-284	Execution with Unnecessary Privileges	predictive	High
3	T1110.001	CWE-798	Improper Restriction of Excessive Authentication Attempts	predictive	High
4	T1211	CWE-254	7PK Security Features	predictive	High
5	T1222	CWE-275	Permission Issues	predictive	High
6	T1548.002	CWE-285	Improper Authorization	predictive	High
7	T1552	CWE-319, CWE-522	Unprotected Storage of Credentials	predictive	High
8	T1587.003	CWE-295	Improper Certificate Validation	predictive	High
9	T1600	CWE-310, CWE-311, CWE-327	Cryptographic Issues	predictive	High

IOA - Indicator of Attack (205)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/	predictive	Low
2	File	/cgi-bin/cgiServer.exx	predictive	High
3	File	/cgi-bin/login_action.cgi	predictive	High
4	File	/cgi-bin/nobody/Search.cgi	predictive	High
5	File	/cgi-bin/webviewer_login_page	predictive	High
6	File	/dev/sg0	predictive	Medium
7	File	/event/runquery.do	predictive	High
8	File	/filemanager/php/connector.php	predictive	High
9	File	/forum/away.php	predictive	High
10	File	/goform/setmac	predictive	High
11	File	/log_download.cgi	predictive	High
12	File	/manager?action=getlogcat	predictive	High
13	File	/mgmt/tm/util/bash	predictive	High
14	File	/pages/systemcall.php?command={COMMAND}	predictive	High
15	File	/password.html	predictive	High
16	File	/system/ws/v11/ss/email	predictive	High
17	File	/uncpath/	predictive	Medium
18	File	add_vhost.php	predictive	High
19	File	admin/images.aspx	predictive	High
20	File	admin/index.php	predictive	High
21	File	adv2.php?action=modify	predictive	High
22	File	agent.cfg	predictive	Medium
23	File	arch/x86/include/asm/fpu/internal.h	predictive	High
24	File	asm/float.c	predictive	Medium
25	File	asm/nasm.c	predictive	Medium
26	File	auth.php	predictive	Medium
27	File	backup.cgi	predictive	Medium
28	File	binder.c	predictive	Medium
29	File	bitfield.c	predictive	Medium
30	File	blob.cpp	predictive	Medium
31	File	books.php	predictive	Medium
32	File	c.php	predictive	Low
33	File	cgi-bin/	predictive	Medium
34	File	cgi-bin/ddns_enc.cgi	predictive	High
35	File	cgi-bin/luci/admin/network/firewall/rules	predictive	High
36	File	cgi-bin/MANGA/admin.cgi	predictive	High
37	File	cli.conf	predictive	Medium
38	File	coders/png.c	predictive	Medium
39	File	coders/tiff.c	predictive	High
40	File	coffgen.c	predictive	Medium
41	File	config.xml	predictive	Medium
42	File	data/gbconfiguration.dat	predictive	High
43	File	db.php	predictive	Low
44	File	detail.php	predictive	Medium
45	File	devtools.sh	predictive	Medium
46	File	domain/section/markdown/markdown.go	predictive	High
47	File	drivers/gpu/drm/udl/udl_fb.c	predictive	High
48	File	drivers/scsi/sr_ioctl.c	predictive	High
49	File	drivers/usb/misc/iowarrior.c	predictive	High
50	File	ebmlstring.c	predictive	Medium
51	File	elf.c	predictive	Low
52	File	events-manager.js	predictive	High
53	File	ExceptionHandler.php	predictive	High
54	File	extensions.load	predictive	High
55	File	FlexPaperViewer.swf	predictive	High
56	File	FortiClientOnlineInstaller.exe	predictive	High
57	File	framework/core/subsystems/expRouter.php	predictive	High
58	File	fs/userfaultfd.c	predictive	High
59	File	function.c	predictive	Medium
60	File	functions.php	predictive	High
61	File	functions_mod_user.php	predictive	High
62	File	getRemoteImage.php	predictive	High
63	File	get_set.ccp	predictive	Medium
64	File	gki_buffer.cc	predictive	High
65	File	handle_load_config.php	predictive	High
66	File	hh.exe	predictive	Low
67	File	image_upload.php	predictive	High
68	File	imap/lmtp_sieve.c	predictive	High
69	File	inc/config.php	predictive	High
70	File	inc/filebrowser/browser.php	predictive	High
71	File	include/findusers.php	predictive	High
72	File	includes/head.inc.php	predictive	High
73	File	index.php	predictive	Medium
74	File	init.inc.php	predictive	Medium
75	File	intervalCheck.jsp	predictive	High
76	File	iptc.c	predictive	Low
77	File	ItemReview.php	predictive	High
78	File	items.c	predictive	Low
79	File	items.queries.php	predictive	High
80	File	item_show.php	predictive	High
81	File	JBIG2Stream.cc	predictive	High
82	File	jeecgFormDemoController.do?commonUpload	predictive	High
83	File	jfinal_cms/admin/filemanager/list	predictive	High
84	File	jpgraph.php	predictive	Medium
85	File	kbdint.c	predictive	Medium
86	File	kernel/events/core.c	predictive	High
87	File	kernel/exit.c	predictive	High
88	File	kernel/trace/trace_events_filter.c	predictive	High
89	File	launchd	predictive	Low
90	File	libnvmmlite_video.so	predictive	High
91	File	libr/asm/asm.c	predictive	High
92	File	main/scala/authentikat/jwt/JsonWebToken.scala	predictive	High
93	File	mm/mempolicy.c	predictive	High
94	File	mm/oom_kill.c	predictive	High
95	File	model/__show_info.php	predictive	High
96	File	modules/m_sasl.c	predictive	High
97	File	NativeNfcManager.cpp	predictive	High
98	File	net/ipv4/datagram.c	predictive	High
99	File	net/ipv4/inet_connection_sock.c	predictive	High
100	File	net/packet/af_packet.c	predictive	High
101	File	openjp2/pi.c	predictive	Medium
102	File	prod.php	predictive	Medium
103	File	prog/htmlviewer.c	predictive	High
104	File	proxy.cgi	predictive	Medium
105	File	public/index.php/home	predictive	High
106	File	public/index.php/home/membersnsfriend/findlist.html	predictive	High
107	File	QueryComponentRendererValue!Default.jspa	predictive	High
108	File	RecentLocationApps.java	predictive	High
109	File	register/check/username?username	predictive	High
110	File	registration_detailed.inc.php	predictive	High
111	File	secure_img_render.php	predictive	High
112	File	setenv.sh	predictive	Medium
113	File	setup/index.php	predictive	High
114	File	shop.cgi	predictive	Medium
115	File	shop_display_products.php	predictive	High
116	File	showcat.php	predictive	Medium
117	File	SimpleDecodingSource.cpp	predictive	High
118	File	software-description.php	predictive	High
119	File	svox_ssml_parser.cpp	predictive	High
120	File	SystemEvent.jsp	predictive	High
121	File	system_log.cgi	predictive	High
122	File	tls1.c	predictive	Low
123	File	ui/artifact/upload	predictive	High
124	File	upgrade_handle.php	predictive	High
125	File	view/ProductsView.php	predictive	High
126	File	welcome.php	predictive	Medium
127	File	www/content/lessons/"lesson	predictive	High
128	Library	AeXNSPkgDLLib.dll	predictive	High
129	Library	ATIDXX64.DLL	predictive	Medium
130	Library	ENCDEC.DLL	predictive	Medium
131	Library	fs/ncpfs/ncplib_kernel.c	predictive	High
132	Library	igcore19d.dll	predictive	High
133	Library	Lib/DocXMLRPCServer.py	predictive	High
134	Library	lib/MongoLite/Database.php	predictive	High
135	Library	lib/rrd.php	predictive	Medium
136	Library	Monitor_win7_x64.sys	predictive	High
137	Library	Monitor_x86.sys	predictive	High
138	Argument	$line	predictive	Low
139	Argument	%s	predictive	Low
140	Argument	agentid	predictive	Low
141	Argument	app	predictive	Low
142	Argument	AUTHENTICATE	predictive	Medium
143	Argument	basePath	predictive	Medium
144	Argument	bauth	predictive	Low
145	Argument	bookid	predictive	Low
146	Argument	cat	predictive	Low
147	Argument	catid	predictive	Low
148	Argument	cat_id	predictive	Low
149	Argument	ccp_act	predictive	Low
150	Argument	code_no	predictive	Low
151	Argument	configFile	predictive	Medium
152	Argument	content	predictive	Low
153	Argument	Content-Length	predictive	High
154	Argument	CPG_M_DIR	predictive	Medium
155	Argument	data3	predictive	Low
156	Argument	err	predictive	Low
157	Argument	file	predictive	Low
158	Argument	filename	predictive	Medium
159	Argument	fromName/message	predictive	High
160	Argument	go	predictive	Low
161	Argument	groups	predictive	Low
162	Argument	id	predictive	Low
163	Argument	ipAddr	predictive	Low
164	Argument	IP address	predictive	Medium
165	Argument	item_id	predictive	Low
166	Argument	l/dl/del	predictive	Medium
167	Argument	layout	predictive	Low
168	Argument	mapTitle	predictive	Medium
169	Argument	mosConfig_absolute_path	predictive	High
170	Argument	name	predictive	Low
171	Argument	page	predictive	Low
172	Argument	password	predictive	Medium
173	Argument	Password	predictive	Medium
174	Argument	phpbb_root_path	predictive	High
175	Argument	priority	predictive	Medium
176	Argument	redirect	predictive	Medium
177	Argument	Referer	predictive	Low
178	Argument	referrer	predictive	Medium
179	Argument	resourceName	predictive	Medium
180	Argument	rootpath	predictive	Medium
181	Argument	sbp	predictive	Low
182	Argument	search	predictive	Low
183	Argument	searchid	predictive	Medium
184	Argument	sid	predictive	Low
185	Argument	site	predictive	Low
186	Argument	sms_content	predictive	Medium
187	Argument	src	predictive	Low
188	Argument	Swfile	predictive	Low
189	Argument	tpldir/filename/type/nid	predictive	High
190	Argument	upfile	predictive	Low
191	Argument	uploaddir	predictive	Medium
192	Argument	up_auto_log	predictive	Medium
193	Argument	url	predictive	Low
194	Argument	uselang	predictive	Low
195	Argument	wd	predictive	Low
196	Argument	_receivers	predictive	Medium
197	Input Value	%0a/%0d	predictive	Low
198	Input Value	./../../../	predictive	Medium
199	Input Value	1" onmouseover=prompt(947671) bad="	predictive	High
200	Input Value	</script><script>alert(1)</script>	predictive	High
201	Input Value	welc0me	predictive	Low
202	Input Value	\x3D../../../../etc/passwd	predictive	High
203	Network Port	8888	predictive	Low
204	Network Port	tcp/873	predictive	Low
205	Network Port	tcp/6200	predictive	Medium

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!