NSO Group Analysis

Activities

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Lang

de	258
en	228
zh	8
es	7
pl	4

Country

de	255
us	154
cn	22
ch	15
gb	6

Actors

NSO Group	500
Agent	3

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Product

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.05	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.37	CVE-2010-0966
3	Cisco Email Security Appliance Attachment Detection input validation	6.3	6.3	$25k-$100k	$25k-$100k	Not Defined	Not Defined	0.04	CVE-2019-1844
4	OpenX adclick.php redirect	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.04	CVE-2014-2230
5	jforum User input validation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	CVE-2019-7550
6	JetBrains Kotlin Build HTTP cryptographic issues	6.8	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	CVE-2019-10101
7	My Link Trader out.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.12
8	Apache HTTP Server mod_rewrite redirect	6.7	6.7	$25k-$100k	$5k-$25k	Not Defined	Not Defined	0.35	CVE-2020-1927
9	PHPUnit HTTP POST eval-stdin.php code injection	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.19	CVE-2017-9841
10	nginx HTTP2 resource consumption	6.4	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	CVE-2018-16843
11	DZCP deV!L`z Clanportal browser.php information disclosure	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.08	CVE-2007-1167
12	Zeus Zeus Web Server memory corruption	10.0	9.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.05	CVE-2010-0359
13	PHPWind goto.php cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	CVE-2015-4135
14	Apache maven-shared-utils Quoted String Commandline command injection	5.5	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	1.77	CVE-2022-29599
15	Cambium cnMaestro Package os command injection	5.7	5.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	CVE-2022-1362
16	Fidelis Network and Deception Web Interface os command injection	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	CVE-2022-24393
17	Ransom.REvil winhttp.dll untrusted search path	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03
18	Ransom.REvil winhttp.dll untrusted search path	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00
19	Microstrategy Web SDK fileToUpload cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	CVE-2020-22987
20	AMD CPU Trusted OS denial of service	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	CVE-2021-26368

Campaigns (3)

These are the campaigns that can be associated with the actor:

Amnesty International Attacks
Xxxxxxx Xxxxxx
Xxxxxxx

IOC - Indicator of Compromise (39)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Type	Confidence
1	3.13.132.96	ec2-3-13-132-96.us-east-2.compute.amazonaws.com	NSO Group	Pegasus	verified	Medium
2	3.16.75.157	ec2-3-16-75-157.us-east-2.compute.amazonaws.com	NSO Group	Pegasus	verified	Medium
3	13.58.85.100	ec2-13-58-85-100.us-east-2.compute.amazonaws.com	NSO Group	Pegasus	verified	Medium
4	13.59.79.240	ec2-13-59-79-240.us-east-2.compute.amazonaws.com	NSO Group	Pegasus	verified	Medium
5	18.191.63.125	ec2-18-191-63-125.us-east-2.compute.amazonaws.com	NSO Group	Pegasus	verified	Medium
6	18.217.13.50	ec2-18-217-13-50.us-east-2.compute.amazonaws.com	NSO Group	Pegasus	verified	Medium
7	18.225.12.72	ec2-18-225-12-72.us-east-2.compute.amazonaws.com	NSO Group	Pegasus	verified	Medium
8	23.239.16.143	li685-143.members.linode.com	NSO Group	Pegasus	verified	High
9	XX.XX.XXX.XX		Xxx Xxxxx		verified	High
10	XX.XX.XXX.XX		Xxx Xxxxx		verified	High
11	XX.XX.XXX.XX	xxxxx.xxxxxxxxx.xxx	Xxx Xxxxx	Xxxxxxx	verified	High
12	XX.X.XX.XXX	xxx-xx-x-xx-xxx.xx-xxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxx Xxxxx	Xxxxxxx Xxxxxx	verified	Medium
13	XX.X.XXX.XX	xxx-xx-x-xxx-xx.xx-xxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxx Xxxxx	Xxxxxxx Xxxxxx	verified	Medium
14	XX.XXX.XX.XXX	xxx-xx-xxx-xx-xxx.xx-xxxxxxxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxx Xxxxx	Xxxxxxx Xxxxxx	verified	Medium
15	XX.XXX.XXX.XXX	xxxxx-xxx.xxxxxxx.xxxxxx.xxx	Xxx Xxxxx	Xxxxxxx	verified	High
16	XX.XXX.XXX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
17	XX.XX.XXX.XXX	xxx-xx-xx-xxx-xxx.xxx.xxxxxxxx.xxx	Xxx Xxxxx	Xxxxxxx Xxxxxx	verified	High
18	XX.XX.XXX.XXX	xxxxx.xxxxxxxx.xxx	Xxx Xxxxx	Xxxxxxx Xxxxxx	verified	High
19	XX.XXX.XX.XXX	xxx.xx-xx-xxx-xx.xx	Xxx Xxxxx	Xxxxxxx	verified	High
20	XX.XXX.XXX.XX	xx.xxx.xxx.xx.xxxxx.xxx	Xxx Xxxxx	Xxxxxxx	verified	Medium
21	XX.XXX.XX.XXX	xxxxxx-xx.xxxxxxxx.xx	Xxx Xxxxx	Xxxxxxx Xxxxxxxxxxxxx Xxxxxxx	verified	High
22	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxx.xxxxxxxxxxxxx.xxx	Xxx Xxxxx	Xxxxxxx	verified	High
23	XXX.XXX.XXX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
24	XXX.XX.XXX.XX	xxx.xx.xxx.xx.xxxxx.xxx	Xxx Xxxxx	Xxxxxxx	verified	Medium
25	XXX.XXX.XXX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
26	XXX.XXX.XXX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
27	XXX.XX.XX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
28	XXX.XX.XXX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
29	XXX.XXX.XXX.XX		Xxx Xxxxx	Xxxxxxx	verified	High
30	XXX.XXX.XX.XX		Xxx Xxxxx	Xxxxxxx	verified	High
31	XXX.XXX.XXX.XX		Xxx Xxxxx	Xxxxxxx Xxxxxx	verified	High
32	XXX.XXX.XX.XX	xxxxx-xx-xx-xx-xxxx-xxxxxxxx-xx.xx.xxxxxxxxxx.xxxxx	Xxx Xxxxx	Xxxxxxx	verified	High
33	XXX.XXX.XX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
34	XXX.XX.XXX.XX		Xxx Xxxxx	Xxxxxxx	verified	High
35	XXX.XXX.XXX.XXX		Xxx Xxxxx	Xxxxxxx	verified	High
36	XXX.XXX.XXX.XX	xxxxxxx-xxxxxxxxxxx.xx	Xxx Xxxxx	Xxxxxxx	verified	High
37	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxx.xxx	Xxx Xxxxx	Xxxxxxx	verified	Medium
38	XXX.XXX.XXX.XX		Xxx Xxxxx	Xxxxxxx	verified	High
39	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxx.xxx	Xxx Xxxxx	Xxxxxxx	verified	Medium

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1040	CWE-294	Authentication Bypass by Capture-replay	predictive	High
2	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
3	T1068	CWE-264, CWE-284	Execution with Unnecessary Privileges	predictive	High
4	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
5	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
7	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	High
8	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
9	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxx Xx Xxxxxxxxxxx	predictive	High
10	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
11	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (165)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/info.php	predictive	High
2	File	/cgi?	predictive	Low
3	File	/etc/controller-agent/agent.conf	predictive	High
4	File	/forms/web_importTFTP	predictive	High
5	File	/forum/away.php	predictive	High
6	File	/graphql	predictive	Medium
7	File	/jeecg-boot/jmreport/view	predictive	High
8	File	/localhost/u	predictive	Medium
9	File	/out.php	predictive	Medium
10	File	/PluXml/core/admin/parametres_edittpl.php	predictive	High
11	File	/public_html/admin/plugins/bad_behavior2/blacklist.php	predictive	High
12	File	/rom-0	predictive	Low
13	File	/root/run/adm.php?admin-ediy&part=exdiy	predictive	High
14	File	/v2/devices/add	predictive	High
15	File	/var/ipfire/backup/bin/backup.pl	predictive	High
16	File	/wp-json/wc/v3/webhooks	predictive	High
17	File	adclick.php	predictive	Medium
18	File	AddEvent.php	predictive	Medium
19	File	admin.php	predictive	Medium
20	File	admin/scripts/FileUploader/php.php	predictive	High
21	File	xxxxx/xxxx_xxxx.xxx	predictive	High
22	File	xxx/xxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxxxxxx.xxx	predictive	High
23	File	xxxxx_xxx.xxx	predictive	High
24	File	xxx_xxxxxxx	predictive	Medium
25	File	xxx.x	predictive	Low
26	File	xxxxxx/xxxxxx/	predictive	High
27	File	xxxxxx/xxxxx.x	predictive	High
28	File	x:\xxxxxx	predictive	Medium
29	File	xxxxxxxxxxxx.xxx	predictive	High
30	File	xxxxxx/xxx.x	predictive	Medium
31	File	xxx.xxxxxxxxxx.xxxxxxxxxxx.xxxxxxxxxxxx	predictive	High
32	File	xxxxxxxx/xxxxxxxx/xxxxxxxxxx_xxx.xxx	predictive	High
33	File	xxxxxx.xxx	predictive	Medium
34	File	xxxxxx/xxxxxx.x	predictive	High
35	File	xxxxx.x	predictive	Low
36	File	xxxxxx/xxxx_xxxxxxxx.xxx	predictive	High
37	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
38	File	xxxx/xxxxxxxx/xxxxxxxx.xxx	predictive	High
39	File	xx.xxx	predictive	Low
40	File	xxxxx.xxx	predictive	Medium
41	File	xxxxxxxxxxxxxxxxx.xxx	predictive	High
42	File	xxxx.xxx	predictive	Medium
43	File	xxx/xxxxxxxx/xxxx_xxxxx_xxxxxxx.x	predictive	High
44	File	xxxxxxxxxxx.x	predictive	High
45	File	xxxxxxxxx.xxx	predictive	High
46	File	xxxx.xxx	predictive	Medium
47	File	xxxxx/xxxxxxx.xxx	predictive	High
48	File	xxxxxxxxx.xxx	predictive	High
49	File	xxxxx-xxxxxxxxx.xxxx	predictive	High
50	File	xxxx_xxxx.x	predictive	Medium
51	File	xxxxx.xxx	predictive	Medium
52	File	xxx/xxxxxx.xxx	predictive	High
53	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
54	File	xxxxx.xxx	predictive	Medium
55	File	xxxxx.xxx?x=xxxxx&x=xxx&x=xxx_xxxx	predictive	High
56	File	xxxx.xxx	predictive	Medium
57	File	xxxxxx.x	predictive	Medium
58	File	xxxxxxxxx/xxx.xxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx.xx	predictive	High
59	File	xxxxx.xxx.xxx	predictive	High
60	File	xxxxxxxx_xxxxxxxx.xxx	predictive	High
61	File	xxxxxxx.xxx	predictive	Medium
62	File	xxxxx_xxxxx.xxx	predictive	High
63	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
64	File	xxx-xxxxxxxx/xxx-xxxxxxxx.xxx	predictive	High
65	File	xxxxxxxx	predictive	Medium
66	File	xxxxxxxx.xx	predictive	Medium
67	File	xxxxxxxxx.x	predictive	Medium
68	File	xxxxxxx.xxx	predictive	Medium
69	File	xxxxxx_xxx_xxxxxx.x	predictive	High
70	File	xxxxx.xxx	predictive	Medium
71	File	xxxxxxxx.xx	predictive	Medium
72	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	High
73	File	xxxx/xxx/xxx.xxx	predictive	High
74	File	xxxx.xxx	predictive	Medium
75	File	xxxx-xxxxxx.x	predictive	High
76	File	xxxxxxxxxxxx.xxx	predictive	High
77	File	xxxx-x.xxx	predictive	Medium
78	File	xxx_xxxx.x	predictive	Medium
79	File	xx.xxx	predictive	Low
80	File	xxxx/xxxxx.xxx	predictive	High
81	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	High
82	File	xxxxxxxxx.xxx	predictive	High
83	File	xxxxxxxxx.xxx	predictive	High
84	File	xxxx_xxxxxxxxx.xx	predictive	High
85	File	xxxxxxxxxx_xxxxxxxxx.xxx	predictive	High
86	File	xxxxxxxxx.xxx	predictive	High
87	File	xx-xxxxx/xxxxx.xxx	predictive	High
88	File	xx-xxxxx/xxxxx.xxx?xxxx=xxx-xxxxxxxxx-xxxxxxxx-xxxxxxxx	predictive	High
89	File	xx-xxx.xxx	predictive	Medium
90	File	xx-xxxxxxxx/xxxx.xxx	predictive	High
91	File	xx-xxxxx.xxx	predictive	Medium
92	File	xxxxxx.xxx	predictive	Medium
93	Library	xxxxxx.xxx	predictive	Medium
94	Library	xxx/xxx.xx	predictive	Medium
95	Library	xxx/xxxx/xxxxxx/xxxx.x	predictive	High
96	Library	xxx/xxxx.x	predictive	Medium
97	Library	xxx/xxxxxxxxxx.x	predictive	High
98	Library	xxxxxxxx.xxx	predictive	Medium
99	Library	xxxxxxx.xxx	predictive	Medium
100	Argument	$xxx_xxxx)	predictive	Medium
101	Argument	xxxxxxx	predictive	Low
102	Argument	xxxx	predictive	Low
103	Argument	xxxxxxxxxxxxxxx	predictive	High
104	Argument	xxxxxxxx	predictive	Medium
105	Argument	xxxxx-xxxxx	predictive	Medium
106	Argument	xxxx_xxxxx	predictive	Medium
107	Argument	xxxx_xx	predictive	Low
108	Argument	xxxxxxxx	predictive	Medium
109	Argument	xxx_xxxxx	predictive	Medium
110	Argument	xxxxxxxxx	predictive	Medium
111	Argument	xxxx	predictive	Low
112	Argument	xxxxxxxxxxx	predictive	Medium
113	Argument	xxxxxx	predictive	Low
114	Argument	xxxx	predictive	Low
115	Argument	xxx_xxxx/xxx_xxxxxxx	predictive	High
116	Argument	xxx/xxxxxxx	predictive	Medium
117	Argument	xxxxxxxx_xxxx	predictive	High
118	Argument	xxxxxx/xxxx	predictive	Medium
119	Argument	xxxx	predictive	Low
120	Argument	xxxxxxxx	predictive	Medium
121	Argument	xxxxxxxx/xxx/xxxxxx/xxxxxxx	predictive	High
122	Argument	xxxxxxxxx	predictive	Medium
123	Argument	xxxxxx	predictive	Low
124	Argument	xxxx	predictive	Low
125	Argument	xx	predictive	Low
126	Argument	xxx	predictive	Low
127	Argument	xxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxx	predictive	High
128	Argument	xxxxxxxxx_xxxx	predictive	High
129	Argument	xxxx	predictive	Low
130	Argument	xxx	predictive	Low
131	Argument	xxxxxxx	predictive	Low
132	Argument	xxxxxx xxxx	predictive	Medium
133	Argument	xxx	predictive	Low
134	Argument	xxxx	predictive	Low
135	Argument	xxxx/xxxxxxx	predictive	Medium
136	Argument	xxxxxxxx	predictive	Medium
137	Argument	x_xxxx	predictive	Low
138	Argument	xxxx_xxx	predictive	Medium
139	Argument	xxxx xxxxxxxx	predictive	High
140	Argument	xxxxxxxx	predictive	Medium
141	Argument	xxxxxxxx	predictive	Medium
142	Argument	xxx	predictive	Low
143	Argument	xxxxxxxxx	predictive	Medium
144	Argument	xxx	predictive	Low
145	Argument	xxxxxx	predictive	Low
146	Argument	xxxxxx_xxxxxxxxxx/xxxxxx_xxxxxx	predictive	High
147	Argument	xxxxxx/xxxxxxxxxxxx/xxxxxxxx	predictive	High
148	Argument	xxxxx_xxxxxx	predictive	Medium
149	Argument	xxx_xxxx	predictive	Medium
150	Argument	xxxx	predictive	Low
151	Argument	xxxx	predictive	Low
152	Argument	xxxxxxxx	predictive	Medium
153	Argument	xxxxxxx	predictive	Low
154	Argument	xxx	predictive	Low
155	Argument	xxxx_xx	predictive	Low
156	Argument	xxxxx_xx	predictive	Medium
157	Argument	xx	predictive	Low
158	Argument	xxx	predictive	Low
159	Argument	xxxxxxxx	predictive	Medium
160	Argument	xxxxxxxx	predictive	Medium
161	Argument	xxxx_xxxx_xxxx	predictive	High
162	Argument	xxxxxxx	predictive	Low
163	Argument	xxx_xxxx	predictive	Medium
164	Network Port	xxx/xxxx	predictive	Medium
165	Network Port	xxx xxxxxx xxxx	predictive	High

References (6)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!