Neurevt Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (13)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	14

Country

us	6
cn	2
gb	2
dk	2

Actors

Neurevt	4
Mirai	1
AgentTesla	1
Zusy	1

Activities

Interest

Timeline

Type

Not Defined	10
SCADA Software	2

Vendor

Belkin	4
Progress	2
Nordex	2
Not Defined	2
Kayako	2

Product

Belkin WeMo	4
Progress MOVEit Transfer	2
Nordex Control 2 SCADA	2
Fonality	2
Kayako eSupport	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Nordex Control 2 SCADA Wind Farm Portal Application cross site scripting	4.3	4.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.02	0.00277	CVE-2015-6477
2	Microsoft Windows CSRSS privileges management	8.1	7.4	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00	0.00056	CVE-2022-22047
3	Progress MOVEit Transfer sql injection	7.3	7.0	$0-$5k	Calculating	Not Defined	Official Fix	0.00	0.00136	CVE-2021-38159
4	Belkin WeMo XML code injection	5.3	4.6	$0-$5k	$0-$5k	Unproven	Official Fix	0.00	0.00284	CVE-2013-6948
5	Belkin WeMo Distribution Feed cryptographic issues	5.3	4.6	$0-$5k	$0-$5k	Unproven	Official Fix	0.03	0.00101	CVE-2013-6950
6	Belkin WeMo STUN/TURN Protocol access control	5.3	4.6	$0-$5k	$0-$5k	Unproven	Official Fix	0.00	0.00729	CVE-2013-6949
7	Microsoft Windows Netlogon Zerologon privileges management	8.4	8.0	$25k-$100k	$0-$5k	High	Official Fix	0.04	0.33347	CVE-2020-1472
8	Kayako eSupport index.php sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00297	CVE-2010-2911
9	Fonality Chrome HUDweb Plugin cryptographic issues	7.4	7.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00348	CVE-2016-2364
10	Yahoo! YUI cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.04	0.00329	CVE-2010-4207
11	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.04	0.00548	CVE-2017-0055

IOC - Indicator of Compromise (12)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	20.41.46.145		Neurevt	04/28/2022	verified	High
2	23.95.225.105	23-95-225-105-host.colocrossing.com	Neurevt	08/18/2021	verified	High
3	40.67.189.14		Neurevt	04/28/2022	verified	High
4	XX.XX.X.XX		Xxxxxxx	04/28/2022	verified	High
5	XX.XXX.XX.XX		Xxxxxxx	04/28/2022	verified	High
6	XX.XXX.XX.XXX	xxxxxx.xxxxxxxx.xx.xx	Xxxxxxx	08/18/2021	verified	High
7	XX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxx	04/28/2022	verified	High
8	XXX.XXX.XXX.XXX		Xxxxxxx	04/28/2022	verified	High
9	XXX.XXX.XXX.XXX	xxxxxxxxxxx-x.xxx-xxxxxxx.xxx	Xxxxxxx	08/18/2021	verified	High
10	XXX.XX.XXX.XXX	xxx.xxxxxxxxxxxx.xxx	Xxxxxxx	04/28/2022	verified	High
11	XXX.XXX.XX.XXX	xxxxx.xxx-xxx-xx.xxxxxx.xxxxxxxxxxxx.xxx	Xxxxxxx	04/28/2022	verified	High
12	XXX.XXX.XXX.XXX		Xxxxxxx	04/28/2022	verified	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CWE-94	Argument Injection	predictive	High
2	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
3	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
5	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (3)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/uncpath/	predictive	Medium
2	File	xxxxx.xxx	predictive	Medium
3	Argument	xxxxxx	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!