Big Head Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (71)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	70
ru	2

Country

TR: Turkey	72

Actors

Big Head	1

Activities

Interest

Timeline

Type

Not Defined	22
Programming Language Software	8
Operating System	6
Content Management System	6
Web Server	4

Vendor

Not Defined	32
Microsoft	4
Apple	4
Cisco	2
Nagios	2

Product

OpenSSH	4
PHP	4
WordPress	4
PostgreSQL	2
nginx	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Google Chrome WebRTC heap-based overflow	7.5	7.4	$25k-$100k	$5k-$25k	High	Official Fix	0.15373	0.00	CVE-2022-2294
2	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	0.75	CVE-2020-12440
3	Telegram information disclosure	4.9	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2021-27205
4	Joget Workflow account_new csv injection	7.0	7.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00166	0.00	CVE-2019-14352
5	KLog Server authenticate.php os command injection	5.5	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.96962	0.00	CVE-2020-35729
6	Zoho ManageEngine PAM360 cross site scripting	4.9	4.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00546	0.00	CVE-2024-27313
7	Pexip Infinity Connect code injection	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00222	0.03	CVE-2021-29655
8	Havelsan Dialogue ACL permission assignment	8.3	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00043	0.04	CVE-2024-3375
9	Nagios XI monitoringwizard.php sql injection	8.0	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00043	0.04	CVE-2024-24401
10	Microsoft Windows code injection	9.9	9.6	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.77026	0.02	CVE-2009-2512
11	Python SimpleHTTPServer Module SimpleHTTPServer.py list_directory cross site scripting	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00422	0.07	CVE-2011-4940
12	CKeditor Paste cross site scripting	5.2	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00111	0.04	CVE-2018-17960
13	CKEditor4 Advanced Content Filter cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00532	0.04	CVE-2021-41164
14	OpenSSH improper authentication	7.3	7.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.01565	0.03	CVE-2010-4478
15	MikroTik RouterOS Web Server out-of-bounds write	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00129	0.04	CVE-2023-30800
16	Microsoft .NET Framework Array Copy memory corruption	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.45279	0.06	CVE-2015-2504
17	CodeBard Patron Button and Widgets for Patreon Plugin cross site scripting	5.6	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00050	0.00	CVE-2023-30491
18	phpBB Error Message memberlist.php input validation	5.3	5.1	$0-$5k	Calculating	Not Defined	Official Fix	0.01803	0.00	CVE-2006-2219
19	WordPress REST API class-wp-rest-users-controller.php information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Functional	Official Fix	0.13142	0.07	CVE-2017-5487
20	Ovidentia CMS index.php sql injection	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00158	0.00	CVE-2021-29343

IOC - Indicator of Compromise (20)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	13.107.21.200		Big Head	08/10/2023	verified	High
2	20.99.133.109		Big Head	08/10/2023	verified	High
3	20.99.184.37		Big Head	08/10/2023	verified	High
4	23.41.86.106	a23-41-86-106.deploy.static.akamaitechnologies.com	Big Head	08/10/2023	verified	High
5	XX.XX.XX.XXX	xxx-xx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
6	XX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
7	XX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
8	XX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
9	XX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
10	XX.XXX.XX.XX	xx.xx.xxx.xx.xxx.xxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
11	XXX.XX.XXX.XX	xxxx-xx-xxx-xx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
12	XXX.XXX.XXX.XXX	xxxx-xxx-xxx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
13	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
14	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
15	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
16	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
17	XXX.XX.XXX.XXX	xx-xxx-xx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
18	XXX.XXX.X.X		Xxx Xxxx	08/10/2023	verified	High
19	XXX.XXX.XXX.XXX		Xxx Xxxx	08/10/2023	verified	High
20	XXX.XX.XXX.XXX	x-xxxx.x-xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	T1059.007	CAPEC-209	CWE-79	Basic Cross Site Scripting	predictive	High
4	TXXXX		CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-XXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX		CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-XX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
10	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (36)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/alumni/admin/ajax.php?action=save_settings	predictive	High
2	File	/cwp_{SESSION_HASH}/admin/loader_ajax.php	predictive	High
3	File	actions/authenticate.php	predictive	High
4	File	admin/dashboard.php	predictive	High
5	File	college_website/admin/ajax.php?action=login	predictive	High
6	File	xxxxxxxxxx/xxx.xx	predictive	High
7	File	xxxxxxxxx/xxxxxxx/xxxx.xxx	predictive	High
8	File	xxxxxxxxxxx.xxx	predictive	High
9	File	xxxxxxxx/xxxxxxxx.x	predictive	High
10	File	xxx/xxxxxxx.xxx	predictive	High
11	File	xxxxxxx_xxxx_xxxxxx.xxx	predictive	High
12	File	xxxx_xxxxxxx.xxx.xxx	predictive	High
13	File	xxxxx.xxx	predictive	Medium
14	File	xx/xxx/xxxxxxxx/xxx_xxxxxxxxx/xxx_xxxxxxxx_xxxxx/_/xxxxxxx_xxx	predictive	High
15	File	xxxxxxxxxx.xxx	predictive	High
16	File	xxxxxxx/xxxx/xxxx_xxxx.xx	predictive	High
17	File	xxxxxxxxxxxxxxxx.xxx	predictive	High
18	File	xxx/xxxxxx/xx_xxxxxx.x	predictive	High
19	File	xxxxxxxxxxxxxxxx.xx	predictive	High
20	File	xxx/xxxxxxx.x	predictive	High
21	File	xxxxxxxxx.x	predictive	Medium
22	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
23	File	\xxx\xxxxx_xxxxxxxxxxxx.xxx	predictive	High
24	Library	xxxxxxxx.xxx	predictive	Medium
25	Argument	xxxxxxx xx/xxxxxxx xxxx	predictive	High
26	Argument	xxxxxxxxxxx	predictive	Medium
27	Argument	xxxxxxxx	predictive	Medium
28	Argument	xx	predictive	Low
29	Argument	xxxxxxxxxxxxxxx	predictive	High
30	Argument	xxxxxxxxx	predictive	Medium
31	Argument	xxxx_xxxxxxx	predictive	Medium
32	Argument	xxxx	predictive	Low
33	Argument	xxxx	predictive	Low
34	Input Value	xxxxxxxx	predictive	Medium
35	Input Value	xxxx+x@!xxxx+	predictive	High
36	Pattern	() {	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!