Konni Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (176)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	112
zh	42
ja	14
es	4
de	4

Country

CN: China	68
US: USA	62
GB: Great Britain	10
KR: South Korea	8
JP: Japan	6

Actors

Konni	11
Cobalt Strike	5
RecordBreaker	4
BumbleBee	3
Meterpreter	3

Activities

Interest

Timeline

Type

Not Defined	54
Router Operating System	22
Operating System	14
Content Management System	10
WordPress Plugin	6

Vendor

Not Defined	38
Microsoft	14
D-Link	10
Juniper	4
Check Point	4

Product

Microsoft Windows	12
WordPress	6
Juniper Junos	4
PRTG Network Monitor	4
OpenBB	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Cisco ASA SSL VPN double free	10.0	9.5	$100k and more	$0-$5k	High	Official Fix	0.94157	0.03	CVE-2018-0101
2	Microsoft Windows SPNEGO Extended Negotiation Remote Code Execution	7.9	7.2	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00756	0.05	CVE-2022-37958
3	Secomea GateManager insufficient privileges	5.9	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00054	0.03	CVE-2022-25782
4	UBI Reader UBIFS File output.py ubireader_extract_files path traversal	6.0	5.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.05	CVE-2022-4572
5	ubi-reader UBIFS File ubireader_extract_files path traversal	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00073	0.05	CVE-2023-0591
6	Microsoft Windows Mark of the Web unknown vulnerability	5.4	5.1	$25k-$100k	$5k-$25k	High	Official Fix	0.00372	0.00	CVE-2022-41091
7	Synacor Zimbra Collaboration Suite sudo Configuration zmslapd access control	8.3	8.3	$0-$5k	$0-$5k	High	Official Fix	0.00114	0.04	CVE-2022-37393
8	vsftpd Service Port 6200 os command injection	8.5	8.4	$25k-$100k	$5k-$25k	Not Defined	Workaround	0.88312	0.08	CVE-2011-2523
9	PRTG Network Monitor HTTP Advanced Sensor HttpAdvancedSensor.exe access control	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00977	0.04	CVE-2018-19204
10	Zyxel USG/USG Flex/Zywall/ATP/VPN Web-based Management Interface improper authentication	7.3	7.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00695	0.05	CVE-2021-35029
11	Oracle Solaris Common Desktop Environment access control	7.8	7.5	$5k-$25k	$0-$5k	High	Official Fix	0.00104	0.00	CVE-2017-3622
12	MikroTik RouterOS SMB memory corruption	8.5	8.4	$0-$5k	$0-$5k	High	Official Fix	0.85476	0.04	CVE-2018-7445
13	Pluto PortletV3AnnotatedDemo information disclosure	6.4	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.92403	0.00	CVE-2018-1306
14	Genivia gSOAP WS-Addressing Plugin integer overflow	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03786	0.08	CVE-2020-13576
15	Bitcoin wallet.dat AES Encryption Padding missing encryption	7.1	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.00
16	VMware vCenter Server DCERPC Protocol out-of-bounds write	9.8	9.6	$25k-$100k	$25k-$100k	High	Official Fix	0.04385	0.00	CVE-2023-34048
17	SourceCodester Employee Task Management System update-employee.php authorization	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.00	CVE-2024-2577
18	Harbor improper authentication	6.9	6.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.07569	0.07	CVE-2022-46463
19	DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection	7.4	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00273	0.07	CVE-2023-1162
20	Apache Tomcat information disclosure	4.0	3.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.03	CVE-2011-2204

IOC - Indicator of Compromise (22)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.8.71.81	t076287416453.example.com	Konni	06/18/2024	verified	Very High
2	31.170.160.129		Konni	12/23/2020	verified	Low
3	31.170.162.63		Konni	12/23/2020	verified	Low
4	31.170.163.30	cpl07.main-hosting.eu	Konni	12/23/2020	verified	Very Low
5	88.119.169.73	22380-37775.bacloud.info	Konni	09/05/2023	verified	High
6	XX.XXX.XXX.XX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	08/31/2023	verified	High
7	XX.XXX.XXX.XX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	09/05/2023	verified	High
8	XX.XXX.XXX.XXX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	07/17/2023	verified	High
9	XXX.XX.XX.XX		Xxxxx	06/18/2024	verified	Very High
10	XXX.XXX.XXX.XXX		Xxxxx	06/18/2024	verified	Very High
11	XXX.XXX.XX.XX		Xxxxx	06/18/2024	verified	Very High
12	XXX.XXX.XXX.XX		Xxxxx	06/18/2024	verified	Very High
13	XXX.XXX.XXX.XX		Xxxxx	06/18/2024	verified	Very High
14	XXX.XXX.XXX.XXX	xxxxxxxx.xxxxxxx.xx.xx	Xxxxx	12/22/2020	verified	Low
15	XXX.XX.XXX.XX		Xxxxx	12/22/2020	verified	Low
16	XXX.XX.XXX.X		Xxxxx	06/18/2024	verified	High
17	XXX.XX.XXX.XXX		Xxxxx	12/23/2020	verified	Low
18	XXX.XXX.XXX.X	xxxxxx-xx.xxxxxxxxxxx.xxx	Xxxxx	06/18/2024	verified	High
19	XXX.XXX.XXX.XX	xxxx.xxxxx.xx.xx	Xxxxx	12/22/2020	verified	Low
20	XXX.XXX.XX.XXX		Xxxxx	06/18/2024	verified	Very High
21	XXX.XXX.XXX.XXX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	06/30/2023	verified	Medium
22	XXX.XXX.XXX.XXX		Xxxxx	06/18/2024	verified	Very High

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-21, CWE-22	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-104	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
9	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
10	TXXXX.XXX	CAPEC-	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
11	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	High
12	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
13	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
14	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (83)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/admin_manage/delete	predictive	High
2	File	/cgi-bin/activate.cgi	predictive	High
3	File	/cgi-bin/system_mgr.cgi	predictive	High
4	File	/config/getuser	predictive	High
5	File	/freelance/resume_list	predictive	High
6	File	/HNAP1	predictive	Low
7	File	/my_photo_gallery/image.php	predictive	High
8	File	/reps/classes/Users.php?f=delete_agent	predictive	High
9	File	/s/	predictive	Low
10	File	/uncpath/	predictive	Medium
11	File	/xxxxxx-xxxxxxxx.xxx	predictive	High
12	File	/xxx/xxxx/xxxx_xxxxx	predictive	High
13	File	xxx.xxx	predictive	Low
14	File	xxxxxxxxxxx\xxxx\xxxxxxxxxx\xxxxxxxxxxxxxxxxx.xxxxx.xxx	predictive	High
15	File	xxxxxx-xxxx.xxx	predictive	High
16	File	xxxxx.xxx	predictive	Medium
17	File	xxx-xxx/xxxx-xxx	predictive	High
18	File	xxxxxxxxx.xxx	predictive	High
19	File	xxxxxxx.xxx	predictive	Medium
20	File	xx.xxx	predictive	Low
21	File	xxxxxxxxx/xxxxxxxxx.xxx	predictive	High
22	File	xxxxxxx/xxx/xxxxxxxx/xx.x	predictive	High
23	File	xxxxxxx_xxxx.xxxx.xxx/xxxxxxx_xxxx.xxx	predictive	High
24	File	xxxx_xxxxxxxx.xxx	predictive	High
25	File	xxxxxxx.xxx	predictive	Medium
26	File	xxxxxx.xxx	predictive	Medium
27	File	xxxxxxxxxxxxxxxxxx.xxx	predictive	High
28	File	xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
29	File	xxx/xxxxxx.xxx	predictive	High
30	File	xxxxxxxx/xxxxx-xx-xxxxxxxxx.xxx	predictive	High
31	File	xxxxxx/xxxxx/xxxxxxxx.x	predictive	High
32	File	xxxxxxxx/xxxx_xxxxxx/xxxx_xxxx_xxxxx.xxx	predictive	High
33	File	xxxxx.xxx	predictive	Medium
34	File	xxxxxxxxxxxx.xxx	predictive	High
35	File	xxxx/xxx_xxx.x	predictive	High
36	File	xxx_xxxxx_xxxx.x	predictive	High
37	File	xxxxxxx.xxx	predictive	Medium
38	File	xxxxxxxxxx.xxx	predictive	High
39	File	xxxx.xxx	predictive	Medium
40	File	xxxxxx/xxxxx/xxxxx.x	predictive	High
41	File	xxxx.xxx	predictive	Medium
42	File	xxxxxxxxx.xxx	predictive	High
43	File	xxxxxxxxx/xxxxx/xxxxxx.xx	predictive	High
44	File	xxx/xxxxx_xxxxxx.xxx	predictive	High
45	File	xxxxxxx.xxx	predictive	Medium
46	File	xxxxxx.xxx	predictive	Medium
47	File	xxx.xxx	predictive	Low
48	File	xxxxxxxxxx.xxx	predictive	High
49	File	xxxxxxx	predictive	Low
50	File	~/xxx/xxxxx.xxx	predictive	High
51	Argument	$_xxxxxx['xxxx_xxxx_xxxxx']	predictive	High
52	Argument	xxxxx_xx	predictive	Medium
53	Argument	xxxxxxxx	predictive	Medium
54	Argument	xxxxxx	predictive	Low
55	Argument	xxx_xx	predictive	Low
56	Argument	xxx	predictive	Low
57	Argument	xxxxxxx	predictive	Low
58	Argument	xxxxxxxx	predictive	Medium
59	Argument	xxxxx.xxx/xxxxx.xxxxxx	predictive	High
60	Argument	xx	predictive	Low
61	Argument	xxxxx	predictive	Low
62	Argument	xxxxxx	predictive	Low
63	Argument	xxx	predictive	Low
64	Argument	xxxxxxxx=xxx>	predictive	High
65	Argument	xxxxxx	predictive	Low
66	Argument	xxxxxxxx	predictive	Medium
67	Argument	xxxxx_xxxx_xxxx	predictive	High
68	Argument	xxxxxxxxx_	predictive	Medium
69	Argument	xxxxxx_xxxx	predictive	Medium
70	Argument	xxxxx	predictive	Low
71	Argument	xxx	predictive	Low
72	Argument	xxxxx	predictive	Low
73	Argument	xxxxxxxxxx_xxxx_xxxxxxx	predictive	High
74	Argument	xxxx_xx	predictive	Low
75	Argument	xxx	predictive	Low
76	Input Value	%xxxxxx+-x+x+xx.x.xx.xxx%xx%xx	predictive	High
77	Input Value	..\	predictive	Low
78	Input Value	x xxxxx xxx xxxxxx xxxx,xxxx,xxxx,xxxx,xxxxxx(xxxxxxxxxxxx,xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,xxxxxxxxxxxx)--	predictive	High
79	Input Value	xxxx</xxxxx><xxxxxx>xxxxx("xxxx")</xxxxxx><xxxxx>	predictive	High
80	Network Port	xxx/xxxx	predictive	Medium
81	Network Port	xxx/xxxx	predictive	Medium
82	Network Port	xxx/xxxxx	predictive	Medium
83	Network Port	xxx/xxx (xxxx)	predictive	High

References (9)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!