APT38 Analysis

Activities

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Lang

en37

Country

Actors

Activities

Interest

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTICVE
1Microsoft Windows DNSAPI DNSAPI.dll access control8.37.9$25k-$100k$5k-$25kNot DefinedOfficial Fix0.05CVE-2017-11779
2Microsoft Windows DNSAPI DNSAPI.dll access control8.17.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.00CVE-2018-8225
3Google Chrome IPC/Gamepad API/V8 code7.36.4$100k and more$5k-$25kUnprovenOfficial Fix0.03CVE-2015-1233
4Google Chrome Blink doSerialize privileges management7.36.4$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.04
5Google Chrome v8 json-stringifier.h SerializeJSArray memory corruption7.37.0$100k and more$5k-$25kNot DefinedOfficial Fix0.00CVE-2015-6764
6nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined2.86CVE-2020-12440
7Microsoft Word memory corruption7.06.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.06CVE-2019-1201
8Microsoft Edge AppContainer Sandbox access control6.56.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.03CVE-2019-0938
9WordPress Thumbnail input validation7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.00CVE-2018-1000773
10Google Chrome Catalog Service input validation8.07.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.04CVE-2018-6055
11Sir GNUboard sql injection6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.03CVE-2014-2339
12Zakkis Technology Php Excel Parser file inclusion7.36.4$0-$5k$0-$5kProof-of-ConceptUnavailable0.03CVE-2007-2857
13Microsoft Windows DNSAPI DNSAPI.dll data processing5.25.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.05CVE-2018-8304
14Oracle HTTP Server Web Listener memory corruption5.35.1$5k-$25k$0-$5kHighOfficial Fix0.07CVE-2010-0425
15Kingsoft WPS Office Free WpsCloudSvr access control6.16.1$0-$5k$0-$5kNot DefinedNot Defined0.00CVE-2018-6400
16Kingsoft WPS Office kso.dll _alloc_iostr_data input validation4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.04CVE-2018-6217
17Google Chrome Sandbox memory corruption5.34.6$100k and more$5k-$25kUnprovenOfficial Fix0.04CVE-2015-1252
18Microsoft Office memory corruption7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.04CVE-2018-0795
19OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial Fix0.41CVE-2016-6210
20Dell EMC Avamar Server/Integrated Data Protection Appliance Installation Manager credentials management8.57.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.06CVE-2018-1217

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsTypeConfidence
1175.45.176.APT38verifiedHigh
2XXX.XX.XXX.XxxxxverifiedHigh
3XXX.XX.XXX.XxxxxverifiedHigh
4XXX.XX.XXX.XxxxxverifiedHigh
5XXX.XX.XXX.XxxxxverifiedHigh

TTP - Tactics, Techniques, Procedures (1)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1068CWE-264, CWE-284Execution with Unnecessary PrivilegespredictiveHigh

IOA - Indicator of Attack (13)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1Filejson-stringifier.hpredictiveHigh
2Filemm/memory.cpredictiveMedium
3File\\.\pipe\WPSCloudSvr\WpsCloudSvrpredictiveHigh
4Libraryxxxxxx.xxxpredictiveMedium
5Libraryxxx.xxxpredictiveLow
6Libraryxxxxxx.xxxpredictiveMedium
7Libraryxxxxxx/xxxxxxxxx/xxxxx.xxxpredictiveHigh
8ArgumentxxxxxxxpredictiveLow
9Argumentxxxxx->xxxxpredictiveMedium
10Argumentxxxxxxxx.xxxxpredictiveHigh
11Argumentxxxxxx_xxxxpredictiveMedium
12ArgumentxxxxxxxxpredictiveMedium
13Input Valuexx-xxxx://predictiveMedium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!