Downeks Analysis

IOB - Indicator of Behavior (13)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en14

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

phpMyAdmin4
FUSE2
IBM FileNet Workplace XT2
PunBB2
OpenWrt2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1Alt-N MDaemon Worldclient injection4.94.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.10855CVE-2021-27182
2ABBYY FineReader License Server link following6.56.3$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00890CVE-2019-20383
3FileZilla Server PORT confused deputy4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00885CVE-2015-10003
4FUSE fusermount access control7.06.3$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.060.02685CVE-2018-10906
5AnyMacro AnyMacro Mail System path traversal5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.020.01213CVE-2011-2468
6IBM FileNet Workplace XT File Upload unrestricted upload7.57.5$5k-$25k$0-$5kNot DefinedNot Defined0.190.02166CVE-2016-8921
7phpMyAdmin import.php access control7.16.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.01055CVE-2013-4729
8OpenWrt/LEDE uhttpd cgi_handle_request Reflected cross site scripting5.25.2$0-$5k$0-$5kNot DefinedNot Defined0.020.00885CVE-2018-19630
9OpenWrt Access Control rpcd access control7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.000.01978CVE-2018-11116
10PunBB profile.php sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.020.00986CVE-2005-1051
11Juniper Web Device Manager Authentication hard-coded credentials9.89.0$5k-$25k$0-$5kProof-of-ConceptWorkaround0.000.00000
12PHP FastCGI Process Manager php-fpm.conf.in access control5.95.2$25k-$100k$0-$5kUnprovenOfficial Fix0.010.01282CVE-2014-0185
13phpMyAdmin server_privileges.lib.php cross site scripting6.56.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.01955CVE-2016-2560

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsTypeConfidence
1185.141.25.68DowneksverifiedHigh

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1006CWE-22Pathname TraversalpredictiveHigh
2T1055CWE-74InjectionpredictiveHigh
3TXXXX.XXXCWE-XXXxxxx Xxxx XxxxxxxxxpredictiveHigh
4TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
5TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx XxxxxxxxpredictiveHigh
6TXXXXCWE-XXXxx XxxxxxxxxpredictiveHigh
7TXXXXCWE-XXXXxxxxxxxxxxxxpredictiveHigh
8TXXXX.XXXCWE-XXXXxxxxxxxxxxx XxxxxxpredictiveHigh

IOA - Indicator of Attack (8)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/etc/config/rpcdpredictiveHigh
2Filecgi-bin/predictiveMedium
3Filexxxxxx.xxxpredictiveMedium
4Filexxx-xxx.xxxx.xxpredictiveHigh
5Filexxxxxxx.xxxpredictiveMedium
6Libraryxxxxxxxxx/xxxxxx_xxxxxxxxxx.xxx.xxxpredictiveHigh
7ArgumentxxxxxxxxxxxxxpredictiveHigh
8ArgumentxxpredictiveLow

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!