Hackers-for-Hire Analysis

IOB - Indicator of Behavior (39)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en28
de8
es4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Alan Ward A-CART4
Apache HTTP Server2
Secomea GateManager2
CrushFTP2
TP-LINK TL-WR840N v42

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Secomea GateManager insufficient privileges5.95.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000540.03CVE-2022-25782
2Alt-N MDaemon Worldclient injection4.94.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000900.07CVE-2021-27182
3TP-LINK TL-WR940N PingIframeRpm.htm ipAddrDispose memory corruption7.57.5$0-$5k$0-$5kProof-of-ConceptWorkaround0.054510.05CVE-2019-6989
4TikiWiki tiki-register.php input validation7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.0107510.00CVE-2006-6168
5sitepress-multilingual-cms Plugin class-wp-installer.php cross-site request forgery6.56.4$0-$5k$0-$5kNot DefinedOfficial Fix0.005790.04CVE-2020-10568
6SourceCodester Web-Based Student Clearance System edit-admin.php sql injection6.36.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.000980.07CVE-2022-3733
7php-fusion downloads.php cross site scripting5.75.7$0-$5k$0-$5kNot DefinedNot Defined0.001590.04CVE-2020-12708
8Gallarific PHP Photo Gallery script gallery.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001360.05CVE-2011-0519
9Gallery My Photo Gallery image.php sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00
10Host Web Server phpinfo.php phpinfo information disclosure5.35.2$5k-$25k$0-$5kNot DefinedWorkaround0.000000.03
11ESMI PayPal Storefront products1h.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.054680.00CVE-2005-0936
12Ecommerce Online Store Kit shop.php sql injection9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.037630.00CVE-2004-0300
13Simple Real Estate Portal System sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.001720.00CVE-2022-28410
14Alan Ward A-CART deliver.asp cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.003940.00CVE-2004-1874
15Alan Ward A-CART category.asp sql injection7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.008380.00CVE-2004-1873
16Hikvision DVR DS-7204HGHI-F1 capabilities User excessive authentication4.54.5$0-$5k$0-$5kNot DefinedNot Defined0.001260.00CVE-2020-7057
17Dahua IPC-HX3XXX Data Packet improper authentication8.17.7$0-$5k$0-$5kNot DefinedOfficial Fix0.256290.03CVE-2021-33044
18Microsoft Windows Win32k privileges management7.36.3$25k-$100k$5k-$25kUnprovenOfficial Fix0.000430.00CVE-2021-1709
19Apache HTTP Server mod_session heap-based overflow7.37.0$25k-$100k$0-$5kNot DefinedOfficial Fix0.705970.04CVE-2021-26691
20CrushFTP redirect6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.000780.04CVE-2018-18288

Campaigns (1)

These are the campaigns that can be associated with the actor:

  • CostaRicto

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (26)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/EXCU_SHELLpredictiveMedium
2File/my_photo_gallery/image.phppredictiveHigh
3File/reps/classes/Users.php?f=delete_agentpredictiveHigh
4FileAdmin/edit-admin.phppredictiveHigh
5Filexxxxxxxx.xxxpredictiveMedium
6Filexxxxxxx.xxxpredictiveMedium
7Filexxxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
8Filexxxxxxx.xxxpredictiveMedium
9Filexxxxxxxx/xxxxx-xx-xxxxxxxxx.xxxpredictiveHigh
10Filexxxxx/xxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxpredictiveHigh
11Filexxxxxxx.xxxpredictiveMedium
12Filexxxxxxxxxxxxx.xxxpredictiveHigh
13Filexxxxxxxxxx.xxxpredictiveHigh
14Filexxxx.xxxpredictiveMedium
15Filexxxxxxxxx.xxxpredictiveHigh
16Filexxxx-xxxxxxxx.xxxpredictiveHigh
17Filexxxxx/xxxxx.xxpredictiveHigh
18ArgumentxxxxxxxpredictiveLow
19Argumentxxx_xxpredictiveLow
20ArgumentxxpredictiveLow
21ArgumentxxxxxpredictiveLow
22ArgumentxxxxxxxxxpredictiveMedium
23ArgumentxxxxxxxxpredictiveMedium
24Input Valuexxx xxxxxxxxpredictiveMedium
25Input Valuex xxxxx xxx xxxxxx xxxx,xxxx,xxxx,xxxx,xxxxxx(xxxxxxxxxxxx,xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,xxxxxxxxxxxx)--predictiveHigh
26Network Portxxx/xx (xxxxxx)predictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you need the next level of professionalism?

Upgrade your account now!