Gafgyt Analysis

IOB - Indicator of Behavior (330)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	270
ru	48
de	4
it	4
ja	2

Country

us	140
sc	124
ru	16
li	10
ca	6

Actors

Gafgyt	5
Mirai	3
Cuba Ransomware	1
Miner	1
EwDoor	1

Activities

Interest

Timeline

Type

Not Defined	88
Content Management System	42
Operating System	16
Groupware Software	16
Web Server	10

Vendor

Not Defined	92
Microsoft	26
Joomla	22
Apache	14
Oracle	10

Product

Joomla CMS	22
Microsoft Windows	12
Apache HTTP Server	8
WordPress	8
Microsoft Exchange Server	8

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Zyxel ARMOR Z1/ARMOR Z2 CGI Program os command injection	8.8	8.8	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.01	0.01005	CVE-2021-4029
2	CKFinder File Name unrestricted upload	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.24	0.01055	CVE-2019-15862
3	Joomla CMS Cache information disclosure	6.4	6.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00954	CVE-2017-9933
4	Joomla CMS CSRF Token cross site scripting	5.2	4.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01	0.02746	CVE-2017-9934
5	Jetty URI access control	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.52164	CVE-2021-34429
6	Microsoft Exchange Server PowerShell ProxyNotShell Privilege Escalation	7.7	7.3	$5k-$25k	$0-$5k	High	Official Fix	0.07	0.31667	CVE-2022-41082
7	Microsoft Windows LSA information disclosure	6.4	5.9	$25k-$100k	$5k-$25k	Functional	Official Fix	0.07	0.26327	CVE-2021-36942
8	ZyXEL USG FLEX 50 CGI Program os command injection	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.95443	CVE-2022-30525
9	VMware ESXi/Workstation/Fusion XHCI USB Controller use after free	8.8	8.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.02	0.01036	CVE-2021-22040
10	Joomla CMS Notes List View sql injection	7.5	7.2	$5k-$25k	$0-$5k	High	Official Fix	0.00	0.14127	CVE-2018-8045
11	Joomla CMS ACL input validation	6.3	6.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.03771	CVE-2020-11890
12	Joomla CMS Filter cross site scripting	5.2	4.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00885	CVE-2017-7986
13	Joomla CMS Error Reporting Path information disclosure	5.3	5.1	$5k-$25k	Calculating	Not Defined	Official Fix	0.02	0.00885	CVE-2017-8057
14	Joomla CMS LDAP Authentication Password ldap injection	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04	0.01018	CVE-2017-14596
15	Microsoft Windows IIS memory corruption	7.9	7.6	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00	0.01140	CVE-2019-1365
16	ActionApps item_content.php3 code injection	6.5	6.2	$0-$5k	Calculating	Proof-of-Concept	Not Defined	0.01	0.15272	CVE-2006-2686
17	nginx Error Page request smuggling	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06	0.01537	CVE-2019-20372
18	Asus RT-AC2900 input validation	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.10938	CVE-2018-8826
19	ConnX ESP HR Management frmLogin.aspx sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	0.01055	CVE-2015-4043
20	GitLab Community Edition/Enterprise Edition Permission permission assignment	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00885	CVE-2019-18446

Campaigns (3)

These are the campaigns that can be associated with the actor:

CVE-2014-8361 / CVE-2017-17215 / CVE-2017-18368
Xxx-xxxx-xxxx / Xxx-xxxx-xxxx
Xxxx Xxxxxxx

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Type	Confidence
1	46.249.32.109	reverse.hostingbb.com	Gafgyt	DDoS Ukraine	verified	High
2	172.245.6.134	172-245-6-134-host.colocrossing.com	Gafgyt		verified	High
3	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xx.xxx.xx	Xxxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxx	verified	High
4	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xx.xxx.xx	Xxxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxx	verified	High
5	XXX.XXX.XXX.XXX		Xxxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxxx / Xxx-xxxx-xxxxx	verified	High
6	XXX.XXX.XXX.X	xxxxxxxxxxxxxxx.xxxx	Xxxxxx		verified	High
7	XXX.XXX.XX.XX		Xxxxxx	Xxxx Xxxxxxx	verified	High
8	XXX.XXX.XXX.XX		Xxxxxx	Xxxx Xxxxxxx	verified	High

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-21, CWE-22, CWE-23	Pathname Traversal	predictive	High
2	T1055	CWE-74	Injection	predictive	High
3	T1059	CWE-94	Cross Site Scripting	predictive	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
8	TXXXX	CWE-XXXX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxx Xx X Xxxxxxxx Xxxxxx	predictive	High
9	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
10	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	High
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
12	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxx.xxx Xxxxxxxxxxxxxxxx: Xxxxxxxx Xx Xxxxxxxxxxxxx Xxxx	predictive	High
13	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
14	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx	predictive	High
15	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
17	TXXXX	CWE-XXX	Xxxxxxxxxxxxx	predictive	High
18	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High
19	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (104)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/sysmon.php	predictive	High
2	File	/api/content/posts/comments	predictive	High
3	File	/cimom	predictive	Low
4	File	/Home/GetAttachment	predictive	High
5	File	/LogoStore/search.php	predictive	High
6	File	/MIME/INBOX-MM-1/	predictive	High
7	File	/modules/projects/vw_files.php	predictive	High
8	File	/sm/api/v1/firewall/zone/services	predictive	High
9	File	/usr/bin/pkexec	predictive	High
10	File	admin/limits.php	predictive	High
11	File	AjaxFileUploadHandler.axd	predictive	High
12	File	auth-gss2.c	predictive	Medium
13	File	xxxxxx.xxx	predictive	Medium
14	File	xxxxxxxxxxxxxxx.xxx	predictive	High
15	File	xxx-xxx/xxxxxxx.xx	predictive	High
16	File	xxx-xxx/xxxx_xxx.xxx	predictive	High
17	File	xxxxxx.x	predictive	Medium
18	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
19	File	xxxx/xxxx	predictive	Medium
20	File	xxxxxx.xxx	predictive	Medium
21	File	xxxxxx_xxx.x	predictive	Medium
22	File	xxxxxxxxxxxxxx.xx	predictive	High
23	File	xxxxxxxx.xxxx	predictive	High
24	File	xxxxxxxxxx.xxxx	predictive	High
25	File	xx/xxxxxxx/xxx.x	predictive	High
26	File	xxx/xx/xxxx/xxxx.xxxxx.xxx	predictive	High
27	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	High
28	File	xxxxx.xxx	predictive	Medium
29	File	xxxxxxx.xxx	predictive	Medium
30	File	xxxx_xxxxxxx.xxxx	predictive	High
31	File	xxxxxx.x	predictive	Medium
32	File	xxxxxxxx.xxx	predictive	Medium
33	File	xxxxxx.xx	predictive	Medium
34	File	xxxxxxxxxxxx/xxx.x	predictive	High
35	File	xxx_xxxxxxxxx.x	predictive	High
36	File	xxxxxxx.xxx	predictive	Medium
37	File	xxx_xxxx.xxx	predictive	Medium
38	File	xxx_xxxxx_xxxx.x	predictive	High
39	File	xxxxxxxxxxxxxx.xxxxx	predictive	High
40	File	xxxxxxx.xxx	predictive	Medium
41	File	xxxxxxx/xxxx	predictive	Medium
42	File	xxx/xxxxx.xxxx	predictive	High
43	File	xxxxxxx.xxx	predictive	Medium
44	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
45	File	xxxxxxxx/xxx/xxxx_xxxxxxxxx/xxxx_xxxxxx_xxxxxxx/xxxx_xxxxxx_xxxxxxx.xxx	predictive	High
46	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
47	File	xxxxxxxx_xxxxxxxxxxxx_xxxxxx.xx	predictive	High
48	File	xxx_xxxxx_xxxxxxxxx.x	predictive	High
49	File	xxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxx	predictive	High
50	File	xxxxxxxxxxxxxxx.xxx	predictive	High
51	File	xxxxxxxx/xxxxxxxxxxxx-xxxxxxxxxx	predictive	High
52	File	xxxxxx/xxxxxxx/xxxxxx/xxxxxxxx.xxx	predictive	High
53	File	xxxx.xxx	predictive	Medium
54	File	xxxxx.xxx	predictive	Medium
55	File	xxx.xxx	predictive	Low
56	File	xxx xxxx xxxxxxx	predictive	High
57	File	xx-xxxxx/xxxxx-xxxxxx.xxx	predictive	High
58	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
59	File	xx-xxxxxxxx/xxxx.xxx	predictive	High
60	File	xxxxxx.xxx?xxxxxx=xxxxxxxxx.xxxx&xxxxxxxxxxx=x	predictive	High
61	Library	xxx-xx-xxx-xxxx-xxxx-xx-x-x.xxx	predictive	High
62	Argument	-x	predictive	Low
63	Argument	xxxxxx	predictive	Low
64	Argument	xxxxxxxxxxxxxx	predictive	High
65	Argument	xxxxxx	predictive	Low
66	Argument	xxxxx$xxxxxxxxxxxxxx$xxxxxxxxxxx	predictive	High
67	Argument	xxxxxx/xxxxxxx	predictive	High
68	Argument	xxxxxxxx[xxxx_xxx]	predictive	High
69	Argument	xxxxxx	predictive	Low
70	Argument	xxxxxxx[xx_xxx_xxxx]	predictive	High
71	Argument	xxxxxxxx xxxx/xxxxxxxx xxxxxxxx/xxxxxxxx xxxxxxx xx/xxxxxxx/xxxx	predictive	High
72	Argument	xx	predictive	Low
73	Argument	xxxxxxxxxxx	predictive	Medium
74	Argument	xxxxxxx_xxxx	predictive	Medium
75	Argument	xxxx	predictive	Low
76	Argument	xxxxx	predictive	Low
77	Argument	xxxxxxxx	predictive	Medium
78	Argument	xxxxxxxxxx	predictive	Medium
79	Argument	xxxx_xxx_xxxxxxxx_xxx	predictive	High
80	Argument	xxxxxxxxxxxxxxxx	predictive	High
81	Argument	xxxxxxx	predictive	Low
82	Argument	xxxxxxxx	predictive	Medium
83	Argument	xxxxxxxx	predictive	Medium
84	Argument	xxxx_xx	predictive	Low
85	Argument	xx	predictive	Low
86	Argument	xxxxx	predictive	Low
87	Argument	xxxxx/xxxxxxxx	predictive	High
88	Argument	xxxxx	predictive	Low
89	Argument	xxxxxx_xxxxxx	predictive	High
90	Argument	xxxxx_xxxxxx_xxxxxxxx	predictive	High
91	Argument	xx_xxx_xxxxx	predictive	Medium
92	Argument	xxx	predictive	Low
93	Argument	xxxxx	predictive	Low
94	Input Value	../	predictive	Low
95	Input Value	x!x@x#x$x%x	predictive	Medium
96	Input Value	xxxx' xxxxx xxx xxxxxx xxxxxx(xxxxxx('xxxxx','xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'),'xxxxx'),xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx-- xxxx&xxxxxx=	predictive	High
97	Input Value	\x	predictive	Low
98	Pattern	xxxxxxx-xxxx\|xx\|	predictive	High
99	Pattern	\|xx xx xx xx\|	predictive	High
100	Network Port	xxxx/xxxx	predictive	Medium
101	Network Port	xxx/xx	predictive	Low
102	Network Port	xxx/xxx	predictive	Low
103	Network Port	xxx/xxxx	predictive	Medium
104	Network Port	xxx/xxxx	predictive	Medium

References (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!