PowerDuke Analysis

IOB - Indicator of Behavior (48)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en48

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

tr12
cn10
hu10
be8
us8

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Juniper Junos8
Microsoft Windows6
Cisco FirePOWER Management Center4
easyii CMS4
Samsung Galaxy S92

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Microsoft Windows LSA Remote Code Execution8.17.6$25k-$100k$5k-$25kHighOfficial Fix0.906170.00CVE-2022-26925
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.00CVE-2007-1192
3Microsoft Windows Common Log File System Driver Privilege Escalation8.17.7$25k-$100k$5k-$25kHighOfficial Fix0.001250.00CVE-2022-37969
4DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009431.10CVE-2010-0966
5Softomi Advanced C2C Marketplace Software sql injection8.58.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000760.00CVE-2023-6145
6Microsoft Windows HTTP Request HTTP.sys code injection7.37.0$25k-$100k$0-$5kHighOfficial Fix0.975370.16CVE-2015-1635
7Lanap BotDetect Captcha Asp.net access control5.34.8$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.034040.02CVE-2006-2918
8Microsoft ASP.NET Core Kestrel Web Application password recovery8.07.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.027830.03CVE-2018-0787
9Red Hat WildFly Blacklist Filter File information disclosure7.57.1$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.098170.00CVE-2016-0793
10CKeditor4 Instance Destroying cross site scripting5.05.0$0-$5k$0-$5kNot DefinedOfficial Fix0.003150.02CVE-2023-28439
11SAP NetWeaver GetComputerSystem information disclosure5.34.6$5k-$25k$0-$5kHighOfficial Fix0.031010.05CVE-2013-3319
12Microsoft Exchange Server Outlook Web Access logon.aspx server-side request forgery7.97.9$5k-$25k$5k-$25kNot DefinedNot Defined0.003790.00CVE-2018-16793
13easyii CMS out cross-site request forgery4.33.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.001020.00CVE-2020-36534
14easyii CMS File Upload Management Upload.php file unrestricted upload6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.001980.04CVE-2022-3771
15Microsoft ASP.NET Security Feature improper authentication7.47.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.004240.06CVE-2018-8171
16Plesk Obsidian Login Page injection5.85.7$0-$5k$0-$5kNot DefinedNot Defined0.001740.04CVE-2023-24044
17Microsoft Windows Scripting Language Remote Code Execution8.88.5$25k-$100k$5k-$25kHighOfficial Fix0.186470.00CVE-2022-41128
18QNAP QVR command injection9.89.6$0-$5k$0-$5kNot DefinedOfficial Fix0.001600.04CVE-2022-27588
19Microsoft Windows User Profile Service Privilege Escalation7.26.9$25k-$100k$5k-$25kHighOfficial Fix0.001020.00CVE-2022-26904
20Microsoft Windows Remote Desktop Protocol Remote Code Execution8.88.1$100k and more$5k-$25kUnprovenOfficial Fix0.015460.02CVE-2022-21893

Campaigns (1)

These are the campaigns that can be associated with the actor:

  • PowerDuke

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/admin/sign/outpredictiveHigh
2File/owa/auth/logon.aspxpredictiveHigh
3File/setup.cgipredictiveMedium
4Filexxxxxxxxxxxxx/xxx_xxxxxxxx.xxxpredictiveHigh
5Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
6Filexxxxxxx/xxxxxx.xxxpredictiveHigh
7Filexxxx.xxxpredictiveMedium
8Filexxx/xxxxxx.xxxpredictiveHigh
9ArgumentxxxxxxxxpredictiveMedium
10ArgumentxxxxpredictiveLow
11ArgumentxxpredictiveLow
12ArgumentxxxxxpredictiveLow
13ArgumentxxxxxxxxpredictiveMedium
14Input Value/../predictiveLow
15Network Portxxx/xxxxpredictiveMedium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!