Gaza Cybergang Analysis

IOB - Indicator of Behavior (41)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en34
de8

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us18
gb10
ws4
de4
nl2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows6
FileZilla Filezilla Server2
Huawei ARXXXX2
Siemens EN100 Ethernet Module2
Banu Tinyproxy2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1jforum User input validation5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.020.04499CVE-2019-7550
2Atlassian JIRA Server/Data Center Service Management Addon injection4.74.5$0-$5k$0-$5kNot DefinedOfficial Fix0.020.01055CVE-2021-39128
3magmi cross-site request forgery8.07.6$0-$5k$0-$5kProof-of-ConceptUnavailable0.010.00885CVE-2020-5776
4Microsoft Exchange Server information disclosure5.44.7$5k-$25k$0-$5kUnprovenOfficial Fix0.010.09127CVE-2021-41349
5Microsoft IIS Unicode path traversal7.36.6$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.020.26556CVE-2000-0884
6Siemens Polarion Web Page Generator Reflected cross site scripting3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00885CVE-2019-13934
7Cisco Unified Communications Manager SOAP API Endpoint code injection8.88.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.010.01156CVE-2021-1362
8Lenovo Integrated Management Module 2 Web Administration memory corruption8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.040.00885CVE-2017-3774
9vsftpd Service Port 6200 os command injection8.58.3$25k-$100k$25k-$100kNot DefinedWorkaround0.050.30487CVE-2011-2523
10TP-LINK TD-8840t HTTP Request tools_admin_1 cross-site request forgery4.64.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.040.00000
11Revive Adserver Flash Cross-Domain Policy crossdomain.xml access control7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020.01213CVE-2015-7369
12Oracle E-Business Suite iRecruitment unknown vulnerability5.35.3$5k-$25k$5k-$25kNot DefinedNot Defined0.000.01055CVE-2010-2408
13Octopus Deploy Package unrestricted upload5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.010.00885CVE-2019-19084
14Cisco IOS XAUTH IKE Authentication improper authentication6.56.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.01055CVE-2005-1058
15Microsoft IIS backdoor9.89.6$25k-$100k$5k-$25kNot DefinedWorkaround0.050.00000
16Cacti Utility api_poller.php sql injection7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020.01974CVE-2013-1434
17Xoops SQL Query page_dbsettings.php sql injection8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.040.00885CVE-2017-11174
18Adobe Flash Player memory corruption8.07.7$25k-$100k$0-$5kNot DefinedOfficial Fix0.000.03097CVE-2018-5002
19Microsoft Windows LNK code injection7.16.8$25k-$100k$5k-$25kNot DefinedOfficial Fix0.060.34599CVE-2018-8345
20Ninja Forms Plugin injection7.36.3$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.000.02362CVE-2018-16308

Campaigns (1)

These are the campaigns that can be associated with the actor:

  • Electric Powder

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1006CWE-22Pathname TraversalpredictiveHigh
2T1055CWE-74InjectionpredictiveHigh
3T1059CWE-94Cross Site ScriptingpredictiveHigh
4TXXXX.XXXCWE-XXXxxxx Xxxx XxxxxxxxxpredictiveHigh
5TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
6TXXXXCWE-XXXxxxxxx XxxxxxxxxpredictiveHigh
7TXXXXCWE-XXXxx XxxxxxxxxpredictiveHigh
8TXXXX.XXXCWE-XXXXxxxxxxxpredictiveHigh
9TXXXXCWE-XXXXxxxxxxxxxxxxpredictiveHigh
10TXXXXCWE-XXXX2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx XxxxxxxxxxpredictiveHigh
11TXXXX.XXXCWE-XXXXxxxxxxxxxxx XxxxxxpredictiveHigh

IOA - Indicator of Attack (17)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/index.php/newsletter/subscriber/new/predictiveHigh
2Fileapi_poller.phppredictiveHigh
3Filecrossdomain.xmlpredictiveHigh
4Filexxx/xxxxxx/xxxxxx/xxxxxxxxxxx/xxx.xxxpredictiveHigh
5Filexxxxx/xxxxx_xxxxx_xpredictiveHigh
6Filexxxxxxx/xxxx_xxxxxxxxxx.xxxpredictiveHigh
7Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveHigh
8Filexxxxx.xxxpredictiveMedium
9Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveHigh
10Libraryx:\xxxxxxx\xxxxxxxx\xxxxxxxxxxx\xxxxxxxxxxxxxx\xxxxxxxx.xxx_xxxxx_xxxxxxxxxxxxxxxx\xxxxx\xxxxxxxxxxx.xxxpredictiveHigh
11Libraryxxxxxx.xxxpredictiveMedium
12ArgumentxxxpredictiveLow
13Argumentxxxxxxxx.xxxxpredictiveHigh
14ArgumentxxxpredictiveLow
15Argumentxxxx->xxxxxxxpredictiveHigh
16Input Valuexx-xxxx://predictiveMedium
17Network Portxxx/xxxxpredictiveMedium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!