Chthonic Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (1000)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en868
zh46
ar16
ja16
ru12

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

nl926
us38
jp16
gb8
cn4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

RedLine Stealer6
Dorkbot5
Domestic Kitten3
Clop2
Bouncing Golf2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

Not Defined246
Operating System150
Content Management System36
Web Server28
WordPress Plugin26

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

Not Defined210
Microsoft156
Cisco50
Apache42
Linux32

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows108
Linux Kernel32
F5 BIG-IP18
Google Android16
Apache HTTP Server14

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.260.00241CVE-2020-12440
2Huawei ACXXXX/SXXXX SSH Packet input validation7.57.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00246CVE-2014-8572
3Microsoft Windows WPAD access control8.07.9$25k-$100k$0-$5kHighOfficial Fix0.030.92124CVE-2016-3213
4Microsoft Windows Graphics Remote Code Execution7.06.1$25k-$100k$5k-$25kUnprovenOfficial Fix0.000.05463CVE-2021-34530
5Microsoft Windows Event Tracing Privilege Escalation7.36.3$25k-$100k$5k-$25kUnprovenOfficial Fix0.000.00043CVE-2021-34487
6Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.040.00548CVE-2017-0055
7Cisco Secure Email and Web Manager Web-based Management Interface improper authentication9.89.6$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.00337CVE-2022-20798
8CS-Cart index.php cross site scripting4.34.1$0-$5k$0-$5kHighOfficial Fix0.000.00297CVE-2008-1458
9nginx Log File link following7.87.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.030.00092CVE-2016-1247
10Apache HTTP Server mod_rewrite redirect6.76.7$25k-$100k$5k-$25kNot DefinedNot Defined0.000.00258CVE-2020-1927
11Microsoft .NET Core/Visual Studio denial of service6.45.5$5k-$25k$0-$5kUnprovenOfficial Fix0.070.00179CVE-2021-26423
12Microsoft Windows TCP/IP Stack Privilege Escalation9.98.6$100k and more$5k-$25kUnprovenOfficial Fix0.030.02183CVE-2021-26424
13Microsoft Windows Event Tracing Privilege Escalation8.37.3$100k and more$5k-$25kUnprovenOfficial Fix0.000.00044CVE-2021-26425
14Microsoft Windows Bluetooth Driver Privilege Escalation8.37.3$100k and more$5k-$25kUnprovenOfficial Fix0.000.00043CVE-2021-34537
15Microsoft Dynamics 365 Privilege Escalation8.57.4$25k-$100k$0-$5kUnprovenOfficial Fix0.000.00736CVE-2021-34524
16Microsoft Windows Storage Spaces Controller Local Privilege Escalation7.86.8$25k-$100k$5k-$25kUnprovenOfficial Fix0.000.00043CVE-2021-34536
17Microsoft Windows Graphics Remote Code Execution7.06.1$25k-$100k$5k-$25kUnprovenOfficial Fix0.000.05463CVE-2021-34533
18Microsoft Windows Services for NFS ONCRPC XDR Driver information disclosure6.45.5$25k-$100k$5k-$25kUnprovenOfficial Fix0.000.00894CVE-2021-36926
19Microsoft ASP.NET Core/Visual Studio information disclosure4.94.3$5k-$25k$0-$5kUnprovenOfficial Fix0.000.00043CVE-2021-34532
20Microsoft Windows Services for NFS ONCRPC XDR Driver information disclosure6.45.5$25k-$100k$5k-$25kUnprovenOfficial Fix0.000.00894CVE-2021-36933

IOC - Indicator of Compromise (146)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
15.34.248.225ns2.newsnet.liChthonic05/05/2022verifiedHigh
25.39.81.111pm.theglu.orgChthonic05/11/2022verifiedHigh
35.103.128.885.103.128.88.static.fibianet.dkChthonic05/05/2022verifiedHigh
45.199.135.170ve1124.venus.servdiscount-customer.comChthonic05/28/2022verifiedHigh
513.107.21.200Chthonic05/05/2022verifiedHigh
613.107.246.13Chthonic05/11/2022verifiedHigh
720.36.253.92Chthonic05/11/2022verifiedHigh
820.41.46.145Chthonic05/05/2022verifiedHigh
920.45.1.107Chthonic04/29/2022verifiedHigh
1020.72.235.82Chthonic05/28/2022verifiedHigh
1120.109.209.108Chthonic05/28/2022verifiedHigh
1223.236.62.147147.62.236.23.bc.googleusercontent.comChthonic05/05/2022verifiedMedium
1331.28.161.68ntp.exact-time.orgChthonic05/05/2022verifiedHigh
1434.107.221.8282.221.107.34.bc.googleusercontent.comChthonic05/11/2022verifiedMedium
1535.229.93.4646.93.229.35.bc.googleusercontent.comChthonic05/05/2022verifiedMedium
1635.231.151.77.151.231.35.bc.googleusercontent.comChthonic05/05/2022verifiedMedium
1735.244.181.201201.181.244.35.bc.googleusercontent.comChthonic05/11/2022verifiedMedium
1837.187.5.167ks3370497.kimsufi.comChthonic05/05/2022verifiedHigh
1937.187.20.28ns397460.ip-37-187-20.euChthonic05/05/2022verifiedHigh
2040.67.189.14Chthonic04/29/2022verifiedHigh
2140.70.224.146Chthonic07/25/2021verifiedHigh
2240.76.4.15Chthonic05/05/2022verifiedHigh
2340.90.247.210Chthonic04/29/2022verifiedHigh
2440.91.124.111Chthonic04/29/2022verifiedHigh
2540.112.72.205Chthonic05/05/2022verifiedHigh
2640.113.200.201Chthonic05/05/2022verifiedHigh
2745.87.76.3ntp.devrandom.beChthonic05/05/2022verifiedHigh
2846.17.46.226brtnjbjgyi.questChthonic05/11/2022verifiedHigh
2946.54.224.12ntp1.kate-wing.siChthonic05/05/2022verifiedHigh
3049.12.125.53telesto.hot-chilli.netChthonic05/28/2022verifiedHigh
31XX.XXX.XXX.XXXxxxx-x.xxxx.xxxXxxxxxxx05/05/2022verifiedHigh
32XX.XX.XX.XXXxxxxx.xxxxxx-xxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
33XX.XXX.XXX.XXXxxxxx.xxxxxx-xxxxxx.xxxXxxxxxxx05/28/2022verifiedHigh
34XX.XXX.XX.XXXxxxxx.xxxx.xxxXxxxxxxx07/25/2021verifiedHigh
35XX.XXX.XX.XXXxxxxxxx09/11/2021verifiedHigh
36XX.XXX.XX.XXXxxxxxxx09/11/2021verifiedHigh
37XX.XX.XXX.XXXxxx.xx-xx-xx-xxx.xxXxxxxxxx05/28/2022verifiedHigh
38XX.XX.XXX.XXXxxx.xxxx.xxxXxxxxxxx05/05/2022verifiedHigh
39XX.XXX.XXX.XXxxxxxx.xxxxxxxxx.xxXxxxxxxx05/28/2022verifiedHigh
40XX.XXX.XX.XXxxx.xxxxxxx.xxXxxxxxxx05/11/2022verifiedHigh
41XX.XXX.XXX.XXxxxxx.xxxxxx.xxxXxxxxxxx05/28/2022verifiedHigh
42XX.XXX.X.XXxxxx.xxx.xxXxxxxxxx05/28/2022verifiedHigh
43XX.XX.XX.XXXxxxxxxxxx.xxx.xxxxxxx.xxXxxxxxxx05/06/2022verifiedHigh
44XX.XXX.XXX.XXXxxxxxxx05/06/2022verifiedHigh
45XX.XXX.X.XXxxxx.xxxx.xxxXxxxxxxx05/06/2022verifiedHigh
46XX.XX.XXX.XXXxxxxxx.xxx.xxx.xx.xx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
47XX.XX.X.XXxxxxxxx05/05/2022verifiedHigh
48XX.XXX.XXX.XXXxx.xxx.xxx.xxx.xxxxxx.xxxx.xxXxxxxxxx05/28/2022verifiedHigh
49XX.XXX.XXX.XXXxxxxxxx05/11/2022verifiedHigh
50XX.XXX.XX.XXXXxxxxxxx07/25/2021verifiedHigh
51XX.XX.XX.XXxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxxxx05/06/2022verifiedHigh
52XX.XXX.XXX.Xxxxx.xxXxxxxxxx05/11/2022verifiedHigh
53XX.XXX.XXX.XXXxxxxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
54XX.XX.XX.XXXxxx.xxxxxxxx.xx.xxXxxxxxxx05/05/2022verifiedHigh
55XX.XXX.XXX.Xxxx.xxxxx-xxx.xxXxxxxxxx05/05/2022verifiedHigh
56XX.XXX.XXX.XXxxxxxx.xxxxx.xxxXxxxxxxx07/25/2021verifiedHigh
57XX.XXX.XXX.XXXxxxx.xxxxxxxxxx.xxXxxxxxxx05/28/2022verifiedHigh
58XX.XX.XX.XXxxxx.xxx.xxxxxxxxxx.xxXxxxxxxx05/28/2022verifiedHigh
59XX.XX.XX.XXxxxx.xxx.xxxxxxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
60XX.XXX.XXX.XXXxxxxxxx07/25/2021verifiedHigh
61XX.XXX.XXX.XXXXxxxxxxx05/06/2022verifiedHigh
62XX.XXX.XX.Xxxx.xxxxxxxx-xxxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
63XX.XXX.XXX.XXxxxxxxxx.xxxxxxxxxxx.xxxXxxxxxxx05/28/2022verifiedHigh
64XX.XXX.XXX.XXXxxxxxx.xx-xxx-xxx-xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxx07/25/2021verifiedHigh
65XX.XXX.XXX.XXxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxxxx05/06/2022verifiedHigh
66XX.XXX.XXX.XXxxx.xxxxxxxx.xxxXxxxxxxx05/11/2022verifiedHigh
67XX.XXX.XXX.XXXXxxxxxxx05/06/2022verifiedHigh
68XX.XXX.XXX.XXXxxxxxxx05/06/2022verifiedHigh
69XX.XXX.XX.Xxxxxxx.xxxx.xxx.xxXxxxxxxx07/25/2021verifiedHigh
70XX.XXX.X.XXxxx-x.xxxx.xxXxxxxxxx07/25/2021verifiedHigh
71XX.XXX.XXX.XXXXxxxxxxx05/06/2022verifiedHigh
72XX.XXX.XXX.XXxxxxxx.xxxxxxxx-xxxxxxx.xxxXxxxxxxx05/06/2022verifiedHigh
73XX.XXX.XXX.XXXxxxx.xxxxxxxxx.xxxXxxxxxxx07/25/2021verifiedHigh
74XX.XX.XX.XXXxxxxxxx07/25/2021verifiedHigh
75XX.XXX.X.Xxxxxxxxxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
76XX.XXX.XX.XXXXxxxxxxx05/11/2022verifiedHigh
77XX.XX.XXX.XXxxxxxxxxxxxx.xxxxxx.xxxx.xxxXxxxxxxx05/28/2022verifiedHigh
78XX.XXX.XXX.XXXXxxxxxxx05/05/2022verifiedHigh
79XX.XXX.XXX.XXXxx-xxx-xxx-xxx.xxxxxx-xx-xxxxxxxxxxx.xxxXxxxxxxx05/06/2022verifiedHigh
80XX.XX.XXX.Xxxx-x.xxxxxx.xxxXxxxxxxx05/06/2022verifiedHigh
81XXX.XX.XX.XXXXxxxxxxx05/06/2022verifiedHigh
82XXX.XX.XX.XXXXxxxxxxx05/06/2022verifiedHigh
83XXX.XX.XXX.XXXXxxxxxxx05/06/2022verifiedHigh
84XXX.XXX.XXX.XXXxxxxxxx09/11/2021verifiedHigh
85XXX.XX.XXX.XXxxxxxxxx-x.xxx.xxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
86XXX.XX.XXX.XXxxxxxxxxx.xxx.xxXxxxxxxx05/11/2022verifiedHigh
87XXX.XXX.XX.XXXxxx.xxxxx.xxXxxxxxxx05/05/2022verifiedHigh
88XXX.XXX.X.XXXxxxx.xxxx.xxx-xxxxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
89XXX.XXX.XX.XXXXxxxxxxx05/06/2022verifiedHigh
90XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
91XXX.XX.XX.Xxxx-xxXxxxxxxx05/05/2022verifiedHigh
92XXX.XX.XXX.XXXxxxxx.xxxxxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
93XXX.XX.XX.XXXxxxxxxx05/28/2022verifiedHigh
94XXX.XX.XX.XXXxxxxxxx05/28/2022verifiedHigh
95XXX.XXX.X.XXxxxxx.xxx.xx.xxXxxxxxxx05/05/2022verifiedHigh
96XXX.XXX.XX.XXXxxxxxx.xx.xxxx.xxXxxxxxxx05/28/2022verifiedHigh
97XXX.XX.XX.XXXxxxx.xx-x.xxxXxxxxxxx07/25/2021verifiedHigh
98XXX.XXX.X.XXXxxxxxxx05/11/2022verifiedHigh
99XXX.XXX.XXX.XXXxx-xxx-xxx-xxx-xxx.xxx.xxx.xxx.xxXxxxxxxx07/25/2021verifiedHigh
100XXX.XXX.XX.XXXxxx.xxxxxxxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
101XXX.XXX.XXX.XXxxxxxxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
102XXX.XXX.XXX.XXXxx-xx-xxxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
103XXX.XXX.XXX.XXXxx-xx-xxxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
104XXX.XXX.XXX.XXXxx-xx-xxxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
105XXX.XXX.XXX.XXXxx-xx-xxxx.xxxxx.xxxXxxxxxxx07/25/2021verifiedHigh
106XXX.XXX.XX.XXxx-xx-xxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
107XXX.XXX.XXX.XXXxx-xx-xxxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
108XXX.XXX.XXX.XXXxx-xx-xxxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
109XXX.XXX.XXX.XXxx-xx-xxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
110XXX.XXX.XXX.XXXxxxxxxx05/28/2022verifiedHigh
111XXX.XXX.XXX.XXXxxxxxxx05/05/2022verifiedHigh
112XXX.X.X.XXXxxxxx.xxx.xxXxxxxxxx07/25/2021verifiedHigh
113XXX.X.XXX.XXXxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
114XXX.XX.XXX.XXXxxxxxxxx.xxxx.xxXxxxxxxx05/05/2022verifiedHigh
115XXX.XX.XXX.XXxxxxx.xxx.xxXxxxxxxx05/05/2022verifiedHigh
116XXX.XXX.XXX.Xxxx-xxx-xxx-x.xxxxxxxx.xxxxxxxxxxxx.xxxXxxxxxxx07/25/2021verifiedHigh
117XXX.XX.XXX.XXXxxxxxxx05/28/2022verifiedHigh
118XXX.XX.XXX.XXxxx.xxx.xxXxxxxxxx05/06/2022verifiedHigh
119XXX.XX.XXX.XXXxxxxxx.xxxXxxxxxxx05/28/2022verifiedHigh
120XXX.XXX.XXX.XXXxx.xxxxxxxxx.xxXxxxxxxx05/28/2022verifiedHigh
121XXX.XXX.XXX.XXXxxxxx.xxxx.xxXxxxxxxx05/05/2022verifiedHigh
122XXX.XXX.XXX.XXXxxxx.xxxxxxx.xxxXxxxxxxx05/28/2022verifiedHigh
123XXX.XXX.XX.XXXxxxxxxxx-x.xxx.xxxxx.xx.xxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
124XXX.XXX.XX.XXxxx.xxxx.xxXxxxxxxx05/11/2022verifiedHigh
125XXX.XXX.XX.XXxxxxxxx.xxxxx.xxxXxxxxxxx05/06/2022verifiedHigh
126XXX.XX.XXX.XXXxxxxxxx05/05/2022verifiedHigh
127XXX.XX.XXX.XXXxxxxxxx.xxxxx.xxXxxxxxxx05/11/2022verifiedHigh
128XXX.XX.XX.XXXxxxxxxx05/05/2022verifiedHigh
129XXX.XXX.XXX.XXxxxx.xxxxxxxxxx.xxXxxxxxxx05/11/2022verifiedHigh
130XXX.XXX.XXX.XXXxxxx.xxxxxxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
131XXX.XX.XXX.XXxxx-xx-xxx-xx.xxx.xxx.xxxxxxxxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
132XXX.XXX.XX.XXXxxxxxx-xxx.xxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
133XXX.XX.XXX.XXXxxxxxxx05/05/2022verifiedHigh
134XXX.XXX.XX.Xxxx.xx.xxx.xxxx.xxXxxxxxxx07/25/2021verifiedHigh
135XXX.XX.XX.XXXxxxxx.xxxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
136XXX.X.XXX.XXXxxxxxxx.xxxx.xxxXxxxxxxx05/11/2022verifiedHigh
137XXX.XX.XXX.XXXx-xxxx.x-xxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
138XXX.XXX.XX.XXXxxxxx.xxx-xxx-xx.xxxxxx.xxxxxxxxxxxx.xxxXxxxxxxx04/29/2022verifiedHigh
139XXX.XX.XXX.XXxx-xx-xxx.xxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
140XXX.X.X.XXXxxxxxx.xxxxxxx.xxXxxxxxxx05/05/2022verifiedHigh
141XXX.XX.XX.XXXxxxxx.xxx.xxXxxxxxxx05/05/2022verifiedHigh
142XXX.X.XX.XXxxxxxx.xxxxxxx.xxxXxxxxxxx05/05/2022verifiedHigh
143XXX.XXX.XXX.XXXxxxxxxxx.xxxxxxxx.xxxXxxxxxxx07/25/2021verifiedHigh
144XXX.XXX.XX.XXXxxxxxxx07/25/2021verifiedHigh
145XXX.XX.XX.XXXxxxxxxxx.xxxxxxxxxxx.xxXxxxxxxx05/06/2022verifiedHigh
146XXX.XXX.XXX.XXXxxxx.xxx-xx.xxxxx.xxx-xxxxx.xxXxxxxxxx05/05/2022verifiedHigh

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1006CWE-21, CWE-22, CWE-23Path TraversalpredictiveHigh
2T1040CWE-294Authentication Bypass by Capture-replaypredictiveHigh
3T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveHigh
4T1059CWE-94, CWE-1321Argument InjectionpredictiveHigh
5T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveHigh
6TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
7TXXXX.XXXCWE-XXX, CWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveHigh
8TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHigh
9TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveHigh
10TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveHigh
11TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveHigh
12TXXXXCWE-XX, CWE-XXXxx XxxxxxxxxpredictiveHigh
13TXXXXCWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveHigh
14TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveHigh
15TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
16TXXXXCWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHigh
17TXXXX.XXXCWE-XXXxxxxxxxxxxxxpredictiveHigh
18TXXXXCWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveHigh
19TXXXX.XXXCWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveHigh
20TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveHigh
21TXXXXCWE-XXXXxxxxxxxxxx XxxxxxpredictiveHigh

IOA - Indicator of Attack (227)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File.travis.ymlpredictiveMedium
2File/.envpredictiveLow
3File/admin.phppredictiveMedium
4File/admin/add-category.phppredictiveHigh
5File/admin/read.php?mudi=getSignalpredictiveHigh
6File/admin/subnets/ripe-query.phppredictiveHigh
7File/apply.cgipredictiveMedium
8File/core/conditions/AbstractWrapper.javapredictiveHigh
9File/debug/pprofpredictiveMedium
10File/exportpredictiveLow
11File/file?action=download&filepredictiveHigh
12File/hardwarepredictiveMedium
13File/librarian/bookdetails.phppredictiveHigh
14File/medical/inventories.phppredictiveHigh
15File/monitoringpredictiveMedium
16File/opt/zimbra/jetty/webapps/zimbra/publicpredictiveHigh
17File/plugin/LiveChat/getChat.json.phppredictiveHigh
18File/plugins/servlet/audit/resourcepredictiveHigh
19File/plugins/servlet/project-config/PROJECT/rolespredictiveHigh
20File/replicationpredictiveMedium
21File/RestAPIpredictiveMedium
22File/tmp/zarafa-vacation-*predictiveHigh
23File/uncpath/predictiveMedium
24File/uploadpredictiveLow
25File/user/loader.php?api=1predictiveHigh
26File/xxx/xxx/xxxxxpredictiveHigh
27File/xxx/xxx/xxxxxxxx.xxxpredictiveHigh
28File/xxxxxx/xxxxxx.xxxxpredictiveHigh
29File/xx-xxxx/xxxxxx/x.x/xxxxx?xxxpredictiveHigh
30Filexxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
31Filexxxxx-xxxx.xxx?xxxxxx=xxx_xxxxxxx xxxxx[x][xxx]predictiveHigh
32Filexxxxxxx.xxxpredictiveMedium
33Filexxxxxxx.xxxpredictiveMedium
34Filexxx/xxx/xxxx-xxxpredictiveHigh
35Filexxxxx.xxxpredictiveMedium
36Filexxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
37Filexxxxxx/xxxxxxxxx.xxpredictiveHigh
38Filexxxx/xxxxxxx/xxx/xxxxxx_xxxx.xpredictiveHigh
39Filexxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
40Filexxxx-xxxx.xpredictiveMedium
41Filexxxx/xxxxxxx.xxxpredictiveHigh
42Filex:\xxxxxxx xxxxx\xxxxxx xxxxx\xxx\xxxxxxx.xxxpredictiveHigh
43Filex:\xxxxxxx\xxxxxxxx\xxxxxx\xxxpredictiveHigh
44Filexxx-xxx/xx.xxxpredictiveHigh
45Filexxx/xxxxxxx.xxpredictiveHigh
46Filexxxxx.xxxpredictiveMedium
47Filexxxxxx.xxxpredictiveMedium
48Filexxx_xxxxxx.xxxpredictiveHigh
49Filexxx.xxxpredictiveLow
50Filexxxxxx.xxxpredictiveMedium
51Filexxxxxxxx.xxpredictiveMedium
52Filexxxxxxxxxx/xxxxxx/xxxxxxxxx.xxxx/xxxx.xxx/predictiveHigh
53Filex_xxxxxxpredictiveMedium
54Filexxxxxx.xxxpredictiveMedium
55Filexxxxxxx.xxxpredictiveMedium
56Filexxxxxxx/xxxxx/xxxxxx.xpredictiveHigh
57Filexxxxxxx/xxx/xxxxxxx/xxxx.xpredictiveHigh
58Filexxxxxxx/xxxx/xxxx_xxxxxxxxx_xxxxx.xpredictiveHigh
59Filexxxx_xxxxx.xxxpredictiveHigh
60Filexxx/xxxxxxxx/xxx_xxxxxxxxxxxx.xpredictiveHigh
61Filexxxxxxxx.xpredictiveMedium
62Filexx/xxxxxxxxx.xpredictiveHigh
63Filexx/xxxxx.xpredictiveMedium
64Filexx/xxxxx/xxxxxxx.xpredictiveHigh
65Filexxxxx.xxxpredictiveMedium
66Filexxxxxxxxxx.xxpredictiveHigh
67Filexxxx/xxxxxxxxxxxxxxxxxxxxxxxx.xxpredictiveHigh
68Filexxxxxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
69Filexxxxx-xxxxx.xpredictiveHigh
70Filexxxxxx_xxxxx_xxxxxxx.xpredictiveHigh
71Filexxxxx-xxxxxxxxxx.xpredictiveHigh
72Filexxxx/xxxx.xpredictiveMedium
73Filexxxxxxx/xxxx.xxxpredictiveHigh
74Filexxxxx.xxpredictiveMedium
75Filexxxxx.xxxpredictiveMedium
76Filexxxxx.xxx?xx=xxxxxxxx.xxxxxxpredictiveHigh
77Filexxxxx:/xxxxxxxx/xxxxxxxxxxxx.xxxxpredictiveHigh
78Filexxxxx/xxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxpredictiveHigh
79Filexxxx_xxxxxx.xxpredictiveHigh
80Filexxxxxx/xxx/xxxxxxxx.xpredictiveHigh
81Filexxxxxx/xxxxx/xxxxx_xxxxxx_xxxxxx.xpredictiveHigh
82Filexxxxxxx/xx_xxx.xpredictiveHigh
83Filexxxxxxxxx/xxxxxxx/xxxxxx/xxxxxxxxxx.xxxpredictiveHigh
84Filexxxx.xxxpredictiveMedium
85Filexxxxx.xxxpredictiveMedium
86Filexxxxx.xxxpredictiveMedium
87Filexxxxxxxxxx/xxx.xpredictiveHigh
88Filexxxx.xpredictiveLow
89Filexxxx.xxxpredictiveMedium
90Filexxxxxx_xxxxx_xxxxxxx.xpredictiveHigh
91Filexxxxxxxxxxxxxxxx.xpredictiveHigh
92Filexx/xxxx.xpredictiveMedium
93Filexxx/xxxxxxxxx/xx_xxxxxx_xxx.xpredictiveHigh
94Filexxx/xxxxxxxxx/x_xxxxxx.xpredictiveHigh
95Filexxx/xxxxxpredictiveMedium
96Filexxxx.xxxpredictiveMedium
97Filexxx_xxxxxxx.xpredictiveHigh
98Filexxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
99Filexxx_xx.xpredictiveMedium
100Filexxxxxxxxxxxxxxxxx.xxxpredictiveHigh
101Filexxxxxxxxx.xxx.xxxpredictiveHigh
102Filexxxxxxx.xxxpredictiveMedium
103Filexxxxxxxx.xxxxpredictiveHigh
104Filexxxxxxxxxxxxx.xxxxpredictiveHigh
105Filexxxxxx.xpredictiveMedium
106Filexxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]predictiveHigh
107Filexxxxxxxx.xxxpredictiveMedium
108Filexxxxxxx.xxxpredictiveMedium
109Filexxxxxxx.xpredictiveMedium
110Filexxxxxxxx-xxx-xxxxxx.xpredictiveHigh
111Filexxxxxxxxxx_xxxxx.xxxxxxpredictiveHigh
112Filexxxx_xxx_xx.xpredictiveHigh
113Filexxx.xxxpredictiveLow
114Filexx_xxx.xpredictiveMedium
115Filexxxxxx/xxxxxxxxxx!xxxxxxx.xxxxpredictiveHigh
116Filexxxxxx.xpredictiveMedium
117Filexxxxx.xxxpredictiveMedium
118Filexxxx-xxxxxx.xpredictiveHigh
119Filexxxxxxx.xpredictiveMedium
120Filexxx/xxx_xxxxx.xpredictiveHigh
121Filexxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
122Filexxxxxxx.xxx.xx.xxxxxxxxxxx.xxxpredictiveHigh
123Filexxxxxx-xxxx/xxx/xxxx/xxxx/xxx/xxxxxx/xxxxxxxxxxxx.xxxxpredictiveHigh
124Filexxxxxxx/xxxxxxx/xxxxxx/xxxxxx_xxxx.xxxpredictiveHigh
125Filexxxx.xxxxxxxxx.xxxpredictiveHigh
126Filexxxx_xxxx.xxxpredictiveHigh
127Filexxxxxx.xxxpredictiveMedium
128Filexxx.xxxpredictiveLow
129Filexxxxxx/xx/xxxx.xxxpredictiveHigh
130Filexx-xxxxx/xxxxx-xxxx.xxxpredictiveHigh
131Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveHigh
132Filexx-xxxxxxxx/xxxxxxx-xxxxxxxx.xxxpredictiveHigh
133Filexx-xxxxxxxx/xxxx.xxxpredictiveHigh
134Filexx/xx/xxxxxpredictiveMedium
135Filexx_xxxxxxx.xpredictiveMedium
136File_xxxxxxxx/xxxxxxxx.xxxpredictiveHigh
137File~/xxxx/xxx/xxxxxxx/xxxxxxxxxx/xxxxxx.xxxpredictiveHigh
138Libraryxxxxx/xxxxxxxxx/xxxx.xxxxxxxxx.xxxpredictiveHigh
139Libraryxxxxxxxx.xxxpredictiveMedium
140Libraryxxxxxxxxxx/xxxxxxxx.xpredictiveHigh
141Libraryxxxxxxxx.xxxpredictiveMedium
142Libraryxxxxxxxxx.xxxpredictiveHigh
143Libraryxxxxxxxx.xxxpredictiveMedium
144Libraryxxxxxx.xxx.xxx.xxxpredictiveHigh
145Libraryxxxxxxxx.xxxpredictiveMedium
146Libraryxxxxxxxx.xxxpredictiveMedium
147Argument-xpredictiveLow
148Argumentxxxxxx_xxxxpredictiveMedium
149ArgumentxxxpredictiveLow
150ArgumentxxxxxpredictiveLow
151Argumentxxx_xxpredictiveLow
152ArgumentxxxxxxpredictiveLow
153Argumentxxxxxxx xxxxpredictiveMedium
154ArgumentxxxxxxxxxxpredictiveMedium
155ArgumentxxxxxxxpredictiveLow
156Argumentxxxxxxx_xxxx->xxx($xxxxxxxx)predictiveHigh
157ArgumentxxxpredictiveLow
158Argumentxxxxxx_xxxxpredictiveMedium
159ArgumentxxxxxxxxpredictiveMedium
160ArgumentxxpredictiveLow
161ArgumentxxpredictiveLow
162ArgumentxxxxxxxxxxxxxxpredictiveHigh
163ArgumentxxxxxxxpredictiveLow
164Argumentxxxxx[xxxxx][xx]predictiveHigh
165Argumentxxxx_xxxxxx_xxxxpredictiveHigh
166Argumentxxxx x xxxxpredictiveMedium
167Argumentxxxxxxxxx/xxxxxxxxxpredictiveHigh
168ArgumentxxxpredictiveLow
169Argumentxx_xxxxpredictiveLow
170ArgumentxxxxpredictiveLow
171ArgumentxxxxpredictiveLow
172ArgumentxxxxxxxxxxxxxxxxxxxxpredictiveHigh
173ArgumentxxpredictiveLow
174Argumentxxxxxxx/xxxx/xxxxxxxxpredictiveHigh
175Argumentxxxxx/xxxxxxpredictiveMedium
176ArgumentxxxxpredictiveLow
177Argumentxxxx_xxxxpredictiveMedium
178ArgumentxxxxxxxxpredictiveMedium
179ArgumentxxxxxxxxpredictiveMedium
180ArgumentxxxxxxxxpredictiveMedium
181ArgumentxxxxxxxxxpredictiveMedium
182Argumentxxx_xxxpredictiveLow
183ArgumentxxxxxxpredictiveLow
184ArgumentxxxxxxpredictiveLow
185Argumentxx_xxxxxxx_xxxxxxxpredictiveHigh
186ArgumentxxxxxxxxxxxxxpredictiveHigh
187ArgumentxxxxxpredictiveLow
188Argumentxxxxxx_xxxxpredictiveMedium
189Argumentxxxxxxx_xxxpredictiveMedium
190ArgumentxxxxxxxxxpredictiveMedium
191ArgumentxxxxpredictiveLow
192ArgumentxxxxxxxpredictiveLow
193ArgumentxxxxxxpredictiveLow
194Argumentxxxxxxxx_xxxxxpredictiveHigh
195ArgumentxxxxxxxxxpredictiveMedium
196ArgumentxxxxxxxxxxxxpredictiveMedium
197ArgumentxxxxxxpredictiveLow
198ArgumentxxxxxxxxxpredictiveMedium
199ArgumentxxxpredictiveLow
200ArgumentxxxxxxpredictiveLow
201ArgumentxxxpredictiveLow
202ArgumentxxxpredictiveLow
203Argumentxxxxxxxx-xxxxxxxxpredictiveHigh
204ArgumentxxxpredictiveLow
205ArgumentxxxxpredictiveLow
206ArgumentxxxxxxxxpredictiveMedium
207ArgumentxxxxxxxpredictiveLow
208Argumentxxxx->xxxxxxxpredictiveHigh
209Argumentx-xxxxxxxxx-xxxpredictiveHigh
210ArgumentxxxpredictiveLow
211Argument\xxxxxx\predictiveMedium
212Argument_xxx_xxxxxxx_xxxxxxx_xxxxxxxxxxxxx_xxx_xxx_xxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_xxxxxxxxxxxxxxxpredictiveHigh
213Argument_xxx_xxxxxxxxxxx_predictiveHigh
214Input Value' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxxpredictiveHigh
215Input Value.%xx.../.%xx.../predictiveHigh
216Input Valuexxx xxxxxxxxpredictiveMedium
217Input ValuexxxxxxxxpredictiveMedium
218Input Valuexxxxxxxxx' xxx 'x'='xpredictiveHigh
219Input ValuexxxxxpredictiveLow
220Input Valuexxxxxxx_xxxxx.xxxxxxx_xxxxxxxpredictiveHigh
221Input Value\xpredictiveLow
222Input Value….//predictiveLow
223Pattern|xx|predictiveLow
224Network PortxxxxxpredictiveLow
225Network Portxx xxxxxxx xxx.xx.xx.xxpredictiveHigh
226Network Portxxx/xx (xxxxxx)predictiveHigh
227Network Portxxx xxxxxx xxxxpredictiveHigh

References (11)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!