Naikon Analysis

Activities

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Lang

en	157
fr	60
de	53
es	26
it	21

Country

us	258
fr	10
cn	2

Actors

Carbanak	338
Naikon	2

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Product

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	CVE
1	WEKA INTEREST Security Scanner Webspider denial of service	2.8	2.7	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.04	CVE-2017-20014
2	Netegrity SiteMinder Login smpwservicescgi.exe redirect	5.4	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.06	CVE-2005-10001
3	Mirmay Secure Private Browser / File Manager Auto Lock improper authentication	3.3	3.3	$0-$5k	$0-$5k	Functional	Workaround	0.00	CVE-2018-25030
4	ISS BlackICE PC Protection Update cleartext transmission	3.7	3.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	CVE-2003-5002
5	WEKA INTEREST Security Scanner Stresstest Configuration denial of service	2.8	2.7	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00	CVE-2017-20013
6	WEKA INTEREST Security Scanner Portscan memory allocation	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.04	CVE-2017-20016
7	ISS BlackICE PC Protection Cross Site Scripting Detection privileges management	5.3	4.8	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.04	CVE-2003-5001
8	WEKA INTEREST Security Scanner LAN Viewer denial of service	2.8	2.7	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00	CVE-2017-20015
9	Kiddoware Kids Place Home Button Protection denial of service	5.3	5.1	$0-$5k	$0-$5k	High	Official Fix	0.04	CVE-2015-10002
10	Shemes GrabIt NZB Date Parser denial of service	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00	CVE-2010-10001
11	WEKA INTEREST Security Scanner HTTP denial of service	2.8	2.7	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.08	CVE-2017-20011
12	TEM FLEX-1080/FLEX-1085 Log information disclosure	5.3	4.7	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.37	CVE-2022-1077
13	DolphinPHP User Management Page cross site scripting	3.5	3.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.04	CVE-2022-1086
14	WEKA INTEREST Security Scanner Stresstest Scheme denial of service	2.8	2.7	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00	CVE-2017-20012
15	ISS BlackICE PC Protection Update cross site scriting	5.0	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00	CVE-2003-5003
16	Brocade Network Advisor DashboardFileReceiveServlet path traversal	8.1	8.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	CVE-2016-8205
17	PostgreSQL numeric error	6.5	5.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.04	CVE-2007-4769
18	Apple tvOS Security inadequate encryption	7.4	7.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	CVE-2016-4693
19	Linux Kernel NFS Subsystem decode_nfs_fh memory corruption	7.6	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	1.02	CVE-2021-4157
20	Akeo Rufus Executable/Rufus Portable Executable untrusted search path	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	1.07	CVE-2022-26620

Campaigns (1)

These are the campaigns that can be associated with the actor:

Camerashy

IOC - Indicator of Compromise (20)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Confidence
1	47.241.127.190		Naikon		High
2	50.117.115.89		Naikon	Camerashy	High
3	50.117.115.90		Naikon	Camerashy	High
4	65.19.141.203	shibakov.org	Naikon	Camerashy	High
5	XX.XX.XXX.XXX	xxxxxxxxxxxxxxxx-x-xx.xxxxxxxx.xxxx.xx.xxx	Xxxxxx	Xxxxxxxxx	High
6	XXX.XX.XX.XX		Xxxxxx	Xxxxxxxxx	High
7	XXX.XXX.XXX.XX		Xxxxxx		High
8	XXX.XXX.XXX.XXX		Xxxxxx	Xxxxxxxxx	High
9	XXX.XXX.XXX.XXX		Xxxxxx		High
10	XXX.XXX.XXX.XXX		Xxxxxx		High
11	XXX.XX.XXX.XXX	xx.xx.xxxx.xxx.xxxxxx.xx-xxxxxxx.xxx	Xxxxxx		High
12	XXX.XX.XXX.XXX	xx.xx.xxxx.xxx.xxxxxx.xx-xxxxxxx.xxx	Xxxxxx		High
13	XXX.XXX.XXX.XXX		Xxxxxx	Xxxxxxxxx	High
14	XXX.XXX.XXX.XXX		Xxxxxx	Xxxxxxxxx	High
15	XXX.XXX.XXX.XXX		Xxxxxx	Xxxxxxxxx	High
16	XXX.XX.XX.XXX	xxx.xx-xx-xxx.xxxx.xxxxxxxxxxx.xxx	Xxxxxx	Xxxxxxxxx	High
17	XXX.XX.XXX.XX	xxxx.xxx.xxxx.xxx.xx	Xxxxxx		High
18	XXX.XXX.XXX.XXX		Xxxxxx	Xxxxxxxxx	High
19	XXX.XXX.XXX.XXX		Xxxxxx	Xxxxxxxxx	High
20	XXX.XX.XXX.XXX	xxxxxx-xx-xxx-xxx-xx-xxx.xxx.xxxxxx.xxx	Xxxxxx		High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Confidence
1	T1059.007	CWE-79, CWE-80	Cross Site Scripting	High
2	T1068	CWE-264, CWE-284	Execution with Unnecessary Privileges	High
3	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	High
4	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	High
5	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxx Xx Xxxxxxxxxxx	High
6	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	High
7	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	High

IOA - Indicator of Attack (113)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Confidence
1	File	%windir%\Internet Logs\	High
2	File	/admin.php/admin/website/data.html	High
3	File	/aqpg/users/login.php	High
4	File	/crypto_keyfile.bin	High
5	File	/cwms/admin/?page=articles/view_article/	High
6	File	/cwms/classes/Master.php?f=save_contact	High
7	File	/mims/app/addcustomerHandler.php	High
8	File	/one_church/userregister.php	High
9	File	/show_news.php	High
10	File	/siteminderagent/pwcgi/smpwservicescgi.exe	High
11	File	/squashfs-root/www/HNAP1/control/SetWizardConfig.php	High
12	File	500page.jsp	Medium
13	File	admin/admin_process.php	High
14	File	xxxxx/xxxx_xxxxxxxx_xxxxxx.xxx	High
15	File	xxxxxxxxxx.xxx	High
16	File	xxxxxx-xxxxxxxxx.xxx	High
17	File	xxxxxxx/xxxxxxxxxx/xxxxxxxxx/xxxxx.xxx	High
18	File	xxxxxx.xx	Medium
19	File	xxxxxx/xxx.x	Medium
20	File	xxxxxxx.xxxxxx.xxx.xx.xxx	High
21	File	xxxxxxxxxx.xxx	High
22	File	xxxxxxxxxxxxxxxxxx.xxx	High
23	File	xxxxx-xxxxxx.xxx	High
24	File	xxxxxxx.xxx	Medium
25	File	xxx_xxx.xxx	Medium
26	File	xxxxxxx.xxx	Medium
27	File	xxxxxxxxx_xxxxxx.x	High
28	File	xxxxxxx.x	Medium
29	File	xxxxx.xxx	Medium
30	File	xxxx_xxx.xxx	Medium
31	File	xxxxxxx.x	Medium
32	File	xxxxxx/xx-xxxxxx_xxx_xx_xxxxxxxxxx/xxxxxx/xxxxxxx/xxxxx/xxxxxxxx/xxx/xxxxxx_xx/xxxxxx/xxx_xxxxxx.x	High
33	File	xxxxxx/xxxxxxx.xxx	High
34	File	xxxx/xxxxx/?xxxx=xxxxxxxxxxx/xxxx_xxxxxxx	High
35	File	xxx/xxxx/xx_xxxx_xxxxx.x	High
36	File	xxxxxxx.xxx	Medium
37	File	xxxxx.xxx	Medium
38	File	xxxxxxxx/xxxxx.xxx	High
39	File	xxxxxx.xxx/xxx-xxx/xxx/xxxxx.xxx	High
40	File	xxxxx/xxx/xxxxxx_xxxxx/!xxxxxxxx?xxxxxxxxxx=xxxx-xxxxx-xx-xxxx.xxxxxxxx_xxxxxxxxxxxxx	High
41	File	xxxxxxxxxxxx.xxx	High
42	File	xxxxxxxx.xxx	Medium
43	File	xxxxxxxx.xxx	Medium
44	File	xxxxxxxxx/xxxxxxx/xxxx/xxxxxxxxxxxxxxxxxxxxxxx.xxx	High
45	File	xxxx_xxxxx.x	Medium
46	File	xxxxxx.xxx	Medium
47	File	xxx/xxxxx/xxx/xx/xx.xxx	High
48	File	xxxx-xxxxxx_xxxxxxxx.xxx	High
49	File	xxx/xxx/xxx-xxxxxx	High
50	File	xxxxxxx.xxx	Medium
51	File	xx-xxxxx/xxxxx.xxx?xxxx=xxxxxxxxxx-xxxxxxx	High
52	File	xxxxxxxxxxxxxx.xxx	High
53	Library	xxxxx.xxx	Medium
54	Library	xxx/xxxxxx/xxxxxxxxx/xxxxxx.x	High
55	Library	xxxxxxx.xxx	Medium
56	Library	xxxxxxxx.xxx	Medium
57	Library	xxxxxxxx.xxx	Medium
58	Library	xxx/xxxx.x	Medium
59	Library	xxx/xxxxx/xxxxx_xxxx.xxx	High
60	Library	xxxxxxxxx.xxx	High
61	Library	xxxxxxxxxxxxx.xxxxxxxxxx	High
62	Library	xxxxxxx	Low
63	Library	xxxxx.xxx	Medium
64	Argument	xxxxx	Low
65	Argument	xxxxxxxxxxxx	Medium
66	Argument	xxx_xx	Low
67	Argument	xx/xxx/xx	Medium
68	Argument	xxx_xxxxxx_xxxx	High
69	Argument	xxxxxxx-xxxxxx	High
70	Argument	xxxxx	Low
71	Argument	xxxxxxxx_xxxx_xxxxxx/xxxxxxx_xxxxxx/xxxxxxx_xxxxxx_xxxxxx/xxxxxxx_xxxx_xxxxxx	High
72	Argument	xxxx	Low
73	Argument	xxxxx[]	Low
74	Argument	xxxxx xxxx/xxxxxx xxxx/xxxx xxxx	High
75	Argument	xxxxx_xxxx	Medium
76	Argument	xx_xxxx	Low
77	Argument	xxxxx_xx	Medium
78	Argument	xxxx_xxxx	Medium
79	Argument	xx	Low
80	Argument	xxxx_xxx_xxxxxx/xxxx_xxx_xxxxxx/xxxx_xxx_xxxxxx/xxxx_xxx_xxxxxx	High
81	Argument	xxxxxxxx/xxxxxxx/xxx/xxxxxx	High
82	Argument	xxx/xxxxx	Medium
83	Argument	x_xx	Low
84	Argument	xxxxxx	Low
85	Argument	xx	Low
86	Argument	xxxx	Low
87	Argument	xxxxx[x]	Medium
88	Argument	x_x_x	Low
89	Argument	xxxxx[x][xxxxxxx]	High
90	Argument	xxxxxxx	Low
91	Argument	xxxxxx/xxxxx	Medium
92	Argument	xxx	Low
93	Argument	xxxxxx_xxxxxx_xxxx_xxxxxxx_xx_xxxx	High
94	Argument	xxxxxx	Low
95	Argument	xxxxx	Low
96	Argument	xxx	Low
97	Argument	xxxxxxxx	Medium
98	Argument	xxxxxxxx	Medium
99	Argument	xxxx/xxxx/xxxxxx	High
100	Argument	xxxx	Low
101	Argument	xxxx xxxx	Medium
102	Input Value	'"><xxx xxx=xx xxxxxxx=xxxxx(x)>.xxx	High
103	Input Value	-x	Low
104	Input Value	xxxxxxxxxxxxxxxx	High
105	Input Value	<xxxx xxxxx="	High
106	Input Value	xxx (xxxxxx xxxx xxxx(xxxxxx xxxxx(),xxxxxx(xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx,xxxxx(xxxx(x)x))x xxxx xxxxxxxxxxx_xxxxxx.xxxxxxxxx_xxxx xxxxx xx x)x)	High
107	Input Value	xxxx://xxx.xxx.x.x/xxx-xxx/xxxxxxxx.xxx?xxxx=/xxx/xxxxxx.xxxxxx	High
108	Input Value	\..	Low
109	Pattern	xxxxxxx.xxx	Medium
110	Pattern	__xxxxxxxxx=	Medium
111	Network Port	xxx/xx	Low
112	Network Port	xxx/xxxx	Medium
113	Network Port	xxx xxxxxx xxxx	High

References (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!