GMERA Analysis

IOB - Indicator of Behavior (24)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en18
zh4
de2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Siemens SIMATIC ET 200SP Open Controller CPU 1515S ...2
Siemens SIMATIC S7-1500 CPU2
Siemens SIMATIC S7-15002
Palo Alto PAN-OS2
Microsoft Windows2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1Siemens LOGO 8 BM TCP Packet buffer overflow7.67.6$5k-$25k$5k-$25kNot DefinedNot Defined0.000.00168CVE-2022-36361
2Cisco ASA/Firepower Threat Defense Web Services Interface input validation6.46.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.97508CVE-2020-3452
3Cisco ASA/Firepower Threat Defense Web Services Interface information disclosure6.46.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.040.01928CVE-2020-3259
4Siemens SIMATIC ET 200SP/SIMATIC S7-1500 Web Server denial of service4.34.3$0-$5k$5k-$25kNot DefinedNot Defined0.000.00105CVE-2020-15796
5Siemens SIMATIC S7-1500 resource consumption6.46.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00124CVE-2019-19281
6Siemens LOGO!8 BM Service Port 135 missing authentication8.27.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00131CVE-2020-7589
7Microsoft IIS IP/Domain Restriction access control6.55.7$25k-$100k$0-$5kUnprovenOfficial Fix0.120.00817CVE-2014-4078
8Apache HTTP Server ap_get_basic_auth_pw improper authentication8.58.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.040.01399CVE-2017-3167
9Linux Kernel Filesystem Layer out-of-bounds write8.87.9$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.030.00189CVE-2021-33909
10Intellian Aptus Web hard-coded credentials8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.080.00659CVE-2020-8000
11Palo Alto PAN-OS GlobalProtect Portal os command injection8.17.7$0-$5k$0-$5kNot DefinedOfficial Fix0.020.66700CVE-2020-2034
12Plesk Onyx Reflected cross site scripting5.25.2$0-$5k$0-$5kNot DefinedNot Defined0.020.00151CVE-2020-11584
13ProMinent MultiFLEX M10a Controller Web Interface information disclosure5.45.4$0-$5k$0-$5kNot DefinedNot Defined0.000.00059CVE-2017-14009
14Sitecore CMS/XP Sitecore.Security.AntiCSRF deserialization8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.030.01277CVE-2019-9874
15Vesta Control Panel index.php file_put_contents Reflected cross site scripting5.25.2$0-$5k$0-$5kNot DefinedNot Defined0.000.00103CVE-2018-10686
16Monstra CMS ZIP File unrestricted upload7.57.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.030.00345CVE-2018-9037
17Adobe Acrobat Reader type conversion7.57.2$25k-$100k$0-$5kNot DefinedOfficial Fix0.000.01601CVE-2017-16379
18Adobe Acrobat Reader use after free7.57.2$25k-$100k$0-$5kNot DefinedOfficial Fix0.000.01143CVE-2017-3113
19Adobe Acrobat Reader memory corruption7.57.2$25k-$100k$0-$5kNot DefinedOfficial Fix0.000.02127CVE-2017-16368
20Microsoft Windows SMB input validation7.77.1$25k-$100k$0-$5kHighOfficial Fix0.020.97116CVE-2017-0146

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
185.209.88.123vm1887998.31ssd.had.wfGMERA05/31/2021verifiedHigh
2XX.XXX.XXX.XXXxxxx05/31/2021verifiedHigh
3XXX.XX.XXX.XXXxxxx05/31/2021verifiedHigh
4XXX.XX.XXX.Xxxxxxx.xxx.xxXxxxx05/31/2021verifiedHigh

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1059.007CWE-79Cross Site ScriptingpredictiveHigh
2T1068CWE-264, CWE-269Execution with Unnecessary PrivilegespredictiveHigh
3TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveHigh
4TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHigh
5TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHigh
6TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveHigh

IOA - Indicator of Attack (5)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1Fileview/file/index.phppredictiveHigh
2Argument$_REQUEST['path']predictiveHigh
3Argument__xxxxxxxxxpredictiveMedium
4Input ValuexxxxxxxxpredictiveMedium
5Network Portxxx/xxxpredictiveLow

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!