APT37 Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (144)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	80
de	36
zh	22
pl	4
es	2

Country

US: USA	90
CN: China	22
PL: Poland	20
RU: Russia	8
ID: Indonesia	2

Actors

APT37	3
Cobalt Strike	1
STRRAT	1
Feodo	1
Houdini	1

Activities

Interest

Timeline

Type

Not Defined	28
Content Management System	8
Groupware Software	4
Policy Management Software	2
Router Operating System	2

Vendor

Not Defined	18
Siemens	4
ONLYOFFICE	4
Synacor	4
DZCP	2

Product

Siemens EN100 Ethernet Module	4
ONLYOFFICE Document Server	4
Synacor Zimbra Collaboration	4
FLDS	2
TikiWiki	2

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	PHP phpinfo cross site scripting	4.3	3.9	$5k-$10k	$0-$1k	Proof-of-Concept	Official fix		0.14028	0.87	CVE-2007-1287
2	Lars Ellingsen Guestserver guestbook.cgi cross site scripting	4.3	4.3	$1k-$2k	$0-$1k	Not defined	Not defined		0.00297	0.10	CVE-2005-4222
3	RDM Intuitive 650 TDB Controller Password access control	7.5	7.2	$2k-$5k	$0-$1k	Not defined	Official fix		0.00227	0.07	CVE-2016-4505
4	Siemens EN100 Ethernet Module Web Server Memory information disclosure	5.3	5.2	$5k-$10k	$0-$1k	Not defined	Official fix		0.00937	0.00	CVE-2016-4785
5	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$2k-$5k	$0-$1k	Proof-of-Concept	Official fix		0.00970	0.78	CVE-2010-0966
6	Siemens EN100 Ethernet Module Web Server information disclosure	5.3	5.2	$5k-$10k	$0-$1k	Not defined	Official fix		0.00937	0.02	CVE-2016-4784
7	RDM Intuitive 650 TDB Controller cross-site request forgery	6.1	5.8	$1k-$2k	$0-$1k	Not defined	Official fix		0.00056	0.00	CVE-2016-4506
8	TikiWiki tiki-register.php input validation	7.3	6.6	$2k-$5k	$0-$1k	Proof-of-Concept	Official fix		0.04277	2.26	CVE-2006-6168
9	LogicBoard CMS away.php redirect	6.3	6.1	$2k-$5k	$0-$1k	Not defined	Unavailable		0.00000	1.88
10	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$2k-$5k	$0-$1k	High	Unavailable	possible	0.01686	0.16	CVE-2007-0354
11	FLDS redir.php sql injection	7.3	7.3	$2k-$5k	$0-$1k	High	Unavailable	possible	0.00202	0.16	CVE-2008-5928
12	SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injection	7.1	6.9	$1k-$2k	$0-$1k	Proof-of-Concept	Not defined		0.00053	0.10	CVE-2023-2090
13	Apple Mac OS X Server Wiki Server sql injection	5.3	4.6	$10k-$25k	$0-$1k	Unproven	Official fix		0.00553	0.87	CVE-2015-5911
14	Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting	3.2	3.2	$0-$1k	$0-$1k	Not defined	Official fix		0.00297	0.09	CVE-2018-25085
15	PHPWind goto.php redirect	6.3	6.3	$1k-$2k	$0-$1k	Not defined	Not defined		0.00365	0.18	CVE-2015-4134
16	D-Link DIR-850L category_view.php improper authentication	8.5	8.2	$10k-$25k	$0-$1k	Proof-of-Concept	Not defined	expected	0.89894	0.07	CVE-2018-9032
17	Winn Winn GuestBook addPost cross site scripting	4.3	4.1	$0-$1k	$0-$1k	High	Official fix	possible	0.00574	0.02	CVE-2011-5026
18	WordPress path traversal	5.7	5.5	$5k-$10k	$0-$1k	Proof-of-Concept	Official fix	possible	0.69885	0.43	CVE-2023-2745
19	Cacti graph_view.php sql injection	8.5	8.4	$1k-$2k	$0-$1k	Not defined	Official fix	expected	0.93360	0.11	CVE-2023-39361
20	Cplinks cpDynaLinks category.php sql injection	7.3	7.1	$2k-$5k	$0-$1k	High	Unavailable	possible	0.00372	0.11	CVE-2007-5408

Campaigns (4)

These are the campaigns that can be associated with the actor:

Daybreak
Scarcruft
Xxxxxxxx Xxxxx
Xxxxx#xxxxx

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	34.13.42.35		APT37	Scarcruft	12/15/2020	verified	Low
2	120.192.73.202		APT37	Scarcruft	12/15/2020	verified	Low
3	XXX.XX.XXX.XXX	xxx-xxx-xx-xxx.xxxxxxx-xxx	Xxxxx		03/18/2024	verified	High
4	XXX.XXX.XX.XX		Xxxxx	Xxxxxxxxx	12/15/2020	verified	Low
5	XXX.XXX.XX.XXX		Xxxxx	Xxxxx#xxxxx	07/26/2022	verified	Medium
6	XXX.XX.XX.XX	xxx.xx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxx	Xxxxxxxx Xxxxx	10/04/2024	verified	High
7	XXX.X.XXX.XX	xxx-x-xxx-xx.xxxxxx.xx	Xxxxx	Xxxxxxxx	12/15/2020	verified	Low

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxx Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX		CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-XXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxxxx	predictive	High
12	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
13	TXXXX		CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (42)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/maintenance/view_designation.php	predictive	High
2	File	/category_view.php	predictive	High
3	File	/forum/away.php	predictive	High
4	File	/upload	predictive	Low
5	File	adclick.php	predictive	Medium
6	File	admin/inst_lang.php	predictive	High
7	File	xxxxxxxx.xxx	predictive	Medium
8	File	xxx/xxxxxxx.xx	predictive	High
9	File	xxxxxxx.xxxx	predictive	Medium
10	File	xxxxx.xxx	predictive	Medium
11	File	xxxxxxxx/xxxxxx.xxx	predictive	High
12	File	xxx/xxxx/xxxxxx/xxxxxx_xxxxxxx.x	predictive	High
13	File	xxxxxxxxxxx.xxx	predictive	High
14	File	xxxx.xxx	predictive	Medium
15	File	xxxxx_xxxx.xxx	predictive	High
16	File	xxxxxxxxx.xxx	predictive	High
17	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	High
18	File	xxx/xxxxxx.xxx	predictive	High
19	File	xxxxxxxx/xxxxxxx.xxx	predictive	High
20	File	xxxxx.xxx	predictive	Medium
21	File	xxxxxxxxx/xxxxxx.xxx	predictive	High
22	File	xxxxxxx.xxx	predictive	Medium
23	File	xxxx.xxxxxx.xx	predictive	High
24	File	xxx_xxxx.xxx	predictive	Medium
25	File	xxxxx.xxx	predictive	Medium
26	File	xxxxxxxxxx_xxxxx.xxxxxx	predictive	High
27	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	High
28	File	xxxx-xxxxxxxx.xxx	predictive	High
29	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
30	Library	xxx/xxxxxx/xxxxxxxxx.xx	predictive	High
31	Argument	xxxxxxxx	predictive	Medium
32	Argument	xxxxxxxx	predictive	Medium
33	Argument	xxxx	predictive	Low
34	Argument	xxxxx	predictive	Low
35	Argument	xx	predictive	Low
36	Argument	xxxxx_xxxx_xxxxxx	predictive	High
37	Argument	xxx	predictive	Low
38	Argument	xxxx	predictive	Low
39	Argument	xxxxxxxx	predictive	Medium
40	Argument	xxxxxx	predictive	Low
41	Argument	xxxxxxxx	predictive	Medium
42	Argument	xxx	predictive	Low

References (6)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!