Hermit Analysis

IOB - Indicator of Behavior (76)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en64
ru10
it2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Moodle4
ImageMagick Engine Plugin4
VMware ESXi2
VMware Workstation2
VMware Fusion2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
11C:Enterprise URL Parameter information disclosure5.95.6$0-$5k$0-$5kNot DefinedOfficial Fix0.001680.07CVE-2021-3131
2Untangle NG Firewall injection6.76.7$0-$5k$0-$5kNot DefinedNot Defined0.001770.04CVE-2019-18647
3ImageMagick Engine Plugin cross-site request forgery6.56.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.016270.06CVE-2022-2441
4WordPress Scheduled Task wp-cron.php resource consumption6.56.5$5k-$25k$0-$5kNot DefinedNot Defined0.001140.05CVE-2023-22622
5Moodle User Profile Field cross site scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.001090.04CVE-2022-45151
6RouterOS DNS Cache Poisoning missing authentication6.56.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.007960.00CVE-2019-3978
7Microsoft Windows Remote Desktop Service BlueKeep input validation9.89.7$25k-$100k$0-$5kHighOfficial Fix0.974990.00CVE-2019-0708
8Aegon Life Image File unrestricted upload6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000430.05CVE-2024-36598
9Joomla CMS sql injection8.58.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.001960.03CVE-2020-10243
10ImageMagick Engine Plugin deserialization7.57.4$0-$5k$0-$5kNot DefinedNot Defined0.000760.00CVE-2022-3568
11Flower Worker Name cross site scripting5.25.2$0-$5kCalculatingNot DefinedNot Defined0.000870.00CVE-2019-16926
12Apache Airflow Celery Provider default_celery.py _get_celery_ssl_active log file5.55.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.005470.00CVE-2023-46215
13Apache RabbitMQ Redis/RabbitMQ os command injection8.58.5$5k-$25k$5k-$25kNot DefinedNot Defined0.935140.04CVE-2020-11981
14Redis Lua sandbox6.36.3$0-$5k$0-$5kHighNot Defined0.971140.07CVE-2022-0543
15Fortinet FortiAuthenticator Reset-Password Page cross site scripting4.94.8$0-$5k$0-$5kNot DefinedOfficial Fix0.000910.00CVE-2022-35850
16Nagios XI update_banner_message sql injection7.17.1$0-$5k$0-$5kNot DefinedNot Defined0.000890.04CVE-2023-40933
17CMS Made Simple Login Cache information disclosure9.89.4$0-$5kCalculatingNot DefinedOfficial Fix0.001850.03CVE-2017-17734
18Mail Masta Plugin campaign_save.php sql injection6.76.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.003160.08CVE-2017-6098
19WordPress Access Restriction user-new.php access control7.57.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.003720.05CVE-2017-17091

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
12.228.150.862-228-150-86.ip192.fastwebnet.itHermit07/30/2022verifiedHigh
22.229.68.1822-229-68-182.ip195.fastwebnet.itHermit07/30/2022verifiedHigh
3XX.XXX.XX.XXXXxxxxx07/30/2022verifiedHigh
4XX.XXX.XX.XXXxxxxx08/04/2022verifiedHigh
5XX.XX.XXX.XXXxx-xx-xxx-xxx.xxxx.xxxxxxxxxx.xxXxxxxx07/30/2022verifiedHigh
6XX.XX.XX.XXxx-xx-xx-xx.xxxxx.xxxxxxxxxx.xxXxxxxx08/04/2022verifiedHigh

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (25)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/admin/template.phppredictiveHigh
2File/inc/campaign_save.phppredictiveHigh
3File/src/helper.cpredictiveHigh
4File/uncpath/predictiveMedium
5Filexxxxxxx.xxxpredictiveMedium
6Filexxxxxxx/xxxxxxxxx/xxxxxx/xxxxxxxxx/xxxxxxx_xxxxxx.xxpredictiveHigh
7Filexxxx_xxxx_xxxxxxxx.xxxpredictiveHigh
8Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
9Filexxxxxx/xxxxxxxx.xpredictiveHigh
10Filexxx_xxxxxxxx.xpredictiveHigh
11Filexxxxxxx.xxxpredictiveMedium
12Filexxx/xxxxxxx.xxxpredictiveHigh
13Filexx-xxxxx/xxxx-xxx.xxxpredictiveHigh
14Filexx-xxxx.xxxpredictiveMedium
15Argumentxxx_xxxxpredictiveMedium
16ArgumentxxpredictiveLow
17ArgumentxxpredictiveLow
18ArgumentxxxxpredictiveLow
19Argumentxxxx_xxpredictiveLow
20Argumentxxxxx_xxxxpredictiveMedium
21ArgumentxxxxxxxxpredictiveMedium
22ArgumentxxxxxxxxxxpredictiveMedium
23ArgumentxxxxxpredictiveLow
24ArgumentxxxxxpredictiveLow
25ArgumentxxxpredictiveLow

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!