APT38 Analysis

IOB - Indicator of Behavior (37)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en38

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us32
kr6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Google Chrome4
WordPress2
rsync2
Oracle HTTP Server2
Dell EMC Avamar Server2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1Microsoft Windows DNSAPI DNSAPI.dll access control8.37.9$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.39320CVE-2017-11779
2Microsoft Windows DNSAPI DNSAPI.dll access control8.17.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.060.34599CVE-2018-8225
3Google Chrome IPC/Gamepad API/V8 code7.36.4$25k-$100k$0-$5kUnprovenOfficial Fix0.040.11270CVE-2015-1233
4Google Chrome Blink doSerialize privileges management7.36.4$25k-$100kCalculatingProof-of-ConceptOfficial Fix0.040.00000
5Google Chrome v8 json-stringifier.h SerializeJSArray memory corruption7.37.0$25k-$100k$5k-$25kNot DefinedOfficial Fix0.030.02172CVE-2015-6764
6nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined5.810.00000CVE-2020-12440
7Microsoft Word memory corruption7.06.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.02116CVE-2019-1201
8Microsoft Edge AppContainer Sandbox access control6.56.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.030.03442CVE-2019-0938
9WordPress Thumbnail input validation7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.050.04571CVE-2018-1000773
10Google Chrome Catalog Service input validation8.07.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.01136CVE-2018-6055
11Sir GNUboard sql injection6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.020.00986CVE-2014-2339
12Zakkis Technology Php Excel Parser file inclusion7.36.4$0-$5k$0-$5kProof-of-ConceptUnavailable0.010.06790CVE-2007-2857
13Microsoft Windows DNSAPI DNSAPI.dll data processing5.25.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.06416CVE-2018-8304
14Oracle HTTP Server Web Listener memory corruption5.35.1$5k-$25k$0-$5kHighOfficial Fix0.020.83982CVE-2010-0425
15Kingsoft WPS Office Free WpsCloudSvr access control6.16.1$0-$5k$0-$5kNot DefinedNot Defined0.030.00885CVE-2018-6400
16Kingsoft WPS Office kso.dll _alloc_iostr_data input validation4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.010.01055CVE-2018-6217
17Google Chrome Sandbox memory corruption5.34.6$25k-$100k$0-$5kUnprovenOfficial Fix0.020.01974CVE-2015-1252
18Microsoft Office memory corruption7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.010.39320CVE-2018-0795
19OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial Fix0.330.49183CVE-2016-6210
20Dell EMC Avamar Server/Integrated Data Protection Appliance Installation Manager credentials management8.57.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.010.08382CVE-2018-1217

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsTypeConfidence
1175.45.176.APT38verifiedHigh
2XXX.XX.XXX.XxxxxverifiedHigh
3XXX.XX.XXX.XxxxxverifiedHigh
4XXX.XX.XXX.XxxxxverifiedHigh
5XXX.XX.XXX.XxxxxverifiedHigh

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1055CWE-74InjectionpredictiveHigh
2T1068CWE-264, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveHigh
3TXXXXCWE-XXXxx XxxxxxxxxpredictiveHigh
4TXXXXCWE-XXXXxx.xxx Xxxxxxxxxxxxxxxx: Xxxxxxxx Xx Xxxxxxxxxxxxx XxxxpredictiveHigh
5TXXXXCWE-XXXXxxxxxxxxxxxxpredictiveHigh
6TXXXX.XXXCWE-XXXxxxxxxxxxxxxpredictiveHigh

IOA - Indicator of Attack (13)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1Filejson-stringifier.hpredictiveHigh
2Filemm/memory.cpredictiveMedium
3File\\.\pipe\WPSCloudSvr\WpsCloudSvrpredictiveHigh
4Libraryxxxxxx.xxxpredictiveMedium
5Libraryxxx.xxxpredictiveLow
6Libraryxxxxxx.xxxpredictiveMedium
7Libraryxxxxxx/xxxxxxxxx/xxxxx.xxxpredictiveHigh
8ArgumentxxxxxxxpredictiveLow
9Argumentxxxxx->xxxxpredictiveMedium
10Argumentxxxxxxxx.xxxxpredictiveHigh
11Argumentxxxxxx_xxxxpredictiveMedium
12ArgumentxxxxxxxxpredictiveMedium
13Input Valuexx-xxxx://predictiveMedium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!