Deep Panda Analysis

IOB - Indicator of Behavior (68)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en64
pl4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us56
cn6
ca6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Kailash Nadh boastMachine2
SmartStoreNET2
rsync2
nginx2
Exacq exacqVision Enterprise System Manager2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.730.04187CVE-2010-0966
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.040.04187CVE-2007-1192
3vsftpd deny_file unknown vulnerability3.73.6$0-$5k$0-$5kNot DefinedOfficial Fix0.240.01136CVE-2015-1419
4nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined6.410.00000CVE-2020-12440
5Exacq exacqVision Enterprise System Manager improper authorization6.16.1$0-$5k$0-$5kNot DefinedNot Defined0.000.01365CVE-2019-7588
6Smartstore WebApi Authentication improper authentication8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.030.00885CVE-2020-15243
7Oracle Solaris Common Desktop Environment format string8.37.9$5k-$25k$0-$5kProof-of-ConceptNot Defined0.020.00885CVE-2022-43752
8JunosOS J-Web input validation7.87.8$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00885CVE-2022-22241
9Microsoft Windows Workstation Service stack-based overflow7.36.8$100k and more$0-$5kHighOfficial Fix0.030.87309CVE-2006-4691
10Todd Miller sudo sudoedit sudoers access control7.87.0$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.040.03821CVE-2015-5602
11WonderCMS Plugin Installer index.php addCustomThemePluginRepository server-side request forgery8.08.0$0-$5k$0-$5kNot DefinedNot Defined0.040.12753CVE-2020-35313
12PostgreSQL os command injection5.95.9$0-$5k$0-$5kHighNot Defined0.050.88202CVE-2019-9193
13Dovecot Indexer-Worker Process memory corruption7.87.5$0-$5k$0-$5kNot DefinedOfficial Fix0.010.01547CVE-2019-7524
14SmartStoreNET Privilege Escalation7.67.3$0-$5k$0-$5kNot DefinedOfficial Fix0.010.00890CVE-2020-27996
15CutePHP CuteNews unrestricted upload7.56.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.030.35200CVE-2019-11447
16Cisco Firepower System Software Detection Engine input validation7.47.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.01055CVE-2019-12697
17Plesk login_up.php3 path traversal5.34.8$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.030.06790CVE-2007-2268
18supervisor supervisord missing authentication7.77.7$0-$5k$0-$5kNot DefinedUnavailable0.010.00954CVE-2019-12105
19Unix chsh privileges management5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.060.00000
20CMS Made Simple News Module Time-Based sql injection7.77.7$0-$5k$0-$5kNot DefinedNot Defined0.030.23092CVE-2019-9053

Campaigns (1)

These are the campaigns that can be associated with the actor:

  • Log4Shell

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1006CWE-22Pathname TraversalpredictiveHigh
2T1059CWE-94Cross Site ScriptingpredictiveHigh
3TXXXX.XXXCWE-XXXxxxx Xxxx XxxxxxxxxpredictiveHigh
4TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
5TXXXXCWE-XXXxxxxxx XxxxxxxxxpredictiveHigh
6TXXXXCWE-XXXXxxxxxxxxx XxxxxxpredictiveHigh
7TXXXXCWE-XXXxx XxxxxxxxxpredictiveHigh
8TXXXX.XXXCWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveHigh
9TXXXXCWE-XXXXxxxxxxxxxxxxpredictiveHigh
10TXXXX.XXXCWE-XXXXxxxxxxxxxxx XxxxxxpredictiveHigh

IOA - Indicator of Attack (17)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/etc/sudoerspredictiveMedium
2Filedata/gbconfiguration.datpredictiveHigh
3Filefs/aio.cpredictiveMedium
4Filexxx/xxxxxx.xxxpredictiveHigh
5Filexxxxx.xxxpredictiveMedium
6Filexxxxx.xxx?xxx=xxxx&xxx=xxxxxxxxpredictiveHigh
7Filexxxxx_xx.xxxxpredictiveHigh
8Filexxx/xxxx/xxxx.xxpredictiveHigh
9Filexxxxxxxx.xpredictiveMedium
10Filexxxxxxxx.xxxpredictiveMedium
11Filexxxxxx/xxx/xx/xxx.xxpredictiveHigh
12Argumentxxxxxx_xxxxpredictiveMedium
13ArgumentxxxxxxxxpredictiveMedium
14Argumentxxxxxx_xxpredictiveMedium
15Argumentxx_xxxxxxpredictiveMedium
16ArgumentxxxpredictiveLow
17Pattern|xx xx|predictiveLow

References (7)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!