RedFoxtrot Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (712)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	620
zh	66
it	8
ja	6
de	6

Country

us	128
cn	112
gb	4
id	2
tr	2

Actors

RedFoxtrot	18
Cobalt Strike	5
IcedID	2
Havoc	1
Tropic Trooper	1

Activities

Interest

Timeline

Type

Not Defined	116
Operating System	110
Web Browser	74
Multimedia Player Software	38
Content Management System	30

Vendor

Not Defined	120
Microsoft	116
Apple	78
IBM	44
Google	32

Product

Microsoft Windows	46
Google Chrome	26
Microsoft Internet Explorer	20
Apple iOS	18
Mozilla Firefox	18

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.04	0.01847	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	1.39	0.00954	CVE-2010-0966
3	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.07	0.00653	CVE-2022-21664
4	TikiWiki tiki-register.php input validation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	10.00	0.00922	CVE-2006-6168
5	SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injection	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00096	CVE-2023-2090
6	LogicBoard CMS away.php redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	1.04	0.00000
7	Drupal Database Connection Error Message information disclosure	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00000
8	Sun Java fontmanager.dll UIManager.getSystemLookAndFeelClassName memory corruption	7.8	7.5	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.03	0.00000
9	Citrix XenServer Web Self Service Management Interface Privilege Escalation	6.3	6.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.02	0.00000
10	WP Statistics Plugin class-wp-statistics-hits.php sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.07	0.00703	CVE-2022-25149
11	xrdp sesman Server integer underflow	7.8	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00042	CVE-2022-23613
12	Liferay Portal CE JSON Payload deserialization	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.01289	CVE-2019-16891
13	Cisco ASA Command Line Interface EpicBanana/JetPlow privileges management	7.8	7.4	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.08	0.97507	CVE-2016-6367
14	Hikvision Product Message command injection	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.97514	CVE-2021-36260
15	VMware ESXi/Workstation/Fusion vmxnet3 Virtual Network Adapter out-of-bounds write	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.00044	CVE-2020-3971
16	Mail Masta Plugin csvexport.php sql injection	8.5	8.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.00597	CVE-2017-6095
17	Apple macOS out-of-bounds	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01	0.00077	CVE-2020-9944
18	Apple tvOS out-of-bounds	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00077	CVE-2020-9943
19	Apple iOS/iPadOS out-of-bounds	4.4	4.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01	0.00077	CVE-2020-9943
20	Microsoft Windows PGM race condition	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00053	CVE-2015-6126

IOC - Indicator of Compromise (22)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	45.32.22.220	45.32.22.220.vultrusercontent.com	RedFoxtrot	10/12/2022	verified	High
2	45.32.146.174	45.32.146.174.vultrusercontent.com	RedFoxtrot	10/12/2022	verified	High
3	45.76.216.62	45.76.216.62.vultrusercontent.com	RedFoxtrot	10/12/2022	verified	High
4	45.77.178.76	thematrix.dev	RedFoxtrot	10/12/2022	verified	High
5	66.42.33.214	66.42.33.214.vultrusercontent.com	RedFoxtrot	10/12/2022	verified	High
6	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	10/12/2022	verified	High
7	XXX.XX.XXX.XX	xxxxxxx-xxxx.xxxxxxxxxxxxxxxx	Xxxxxxxxxx	10/12/2022	verified	High
8	XXX.XXX.XXX.XXX		Xxxxxxxxxx	10/12/2022	verified	High
9	XXX.XXX.XXX.XX		Xxxxxxxxxx	10/12/2022	verified	High
10	XXX.XXX.XXX.XXX	xx-xxxxxxx-xxxxxx-xxxxxxxx.xxxxx.xxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	10/12/2022	verified	High
11	XXX.XX.XXX.XXX	xxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	10/12/2022	verified	High
12	XXX.XX.XXX.XXX		Xxxxxxxxxx	10/12/2022	verified	High
13	XXX.XXX.XXX.X		Xxxxxxxxxx	10/12/2022	verified	High
14	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	10/12/2022	verified	High
15	XXX.XXX.XXX.XXX		Xxxxxxxxxx	10/12/2022	verified	High
16	XXX.XXX.XXX.XXX		Xxxxxxxxxx	10/12/2022	verified	High
17	XXX.XXX.XXX.XX		Xxxxxxxxxx	10/12/2022	verified	High
18	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	10/12/2022	verified	High
19	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	10/12/2022	verified	High
20	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	10/12/2022	verified	High
21	XXX.XXX.XXX.XXX		Xxxxxxxxxx	10/12/2022	verified	High
22	XXX.XXX.XXX.XXX	xxxxxxxxxxxxxx.xxxxx	Xxxxxxxxxx	10/12/2022	verified	High

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-21, CWE-22, CWE-24	Pathname Traversal	predictive	High
2	T1040	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CWE-74	Injection	predictive	High
4	T1059	CWE-94	Cross Site Scripting	predictive	High
5	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
6	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxx Xxxxxxxxxxx Xxx Xxx Xxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XXX, CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
11	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
12	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
13	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxx.xxx Xxxxxxxxxxxxxxxx: Xxxxxxxx Xx Xxxxxxxxxxxxx Xxxx	predictive	High
14	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx	predictive	High
15	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
16	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx	predictive	High
17	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	High
18	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High
19	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High
20	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (184)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/maintenance/view_designation.php	predictive	High
2	File	/admin/sys_sql_query.php	predictive	High
3	File	/app/Http/Controllers/Admin/NEditorController.php	predictive	High
4	File	/cgi-bin/luci/api/wireless	predictive	High
5	File	/forum/away.php	predictive	High
6	File	/getcfg.php	predictive	Medium
7	File	/group1/uploa	predictive	High
8	File	/inc/lists/csvexport.php	predictive	High
9	File	/server-status	predictive	High
10	File	/sgmi/	predictive	Low
11	File	/system/user/resetPwd	predictive	High
12	File	/tos/index.php?editor/fileGet	predictive	High
13	File	/uncpath/	predictive	Medium
14	File	/user/updatePwd	predictive	High
15	File	/var/log/nginx	predictive	High
16	File	addentry.php	predictive	Medium
17	File	admin-ajax.php?action=get_wdtable order[0][dir]	predictive	High
18	File	admin/plib/api-rpc/Agent.php	predictive	High
19	File	applications/core/modules/front/system/content.php	predictive	High
20	File	auth-gss2.c	predictive	Medium
21	File	bcbadmSettings.jsp	predictive	High
22	File	xxxxx.xxx	predictive	Medium
23	File	xxx.x	predictive	Low
24	File	xxxxx/xxxxxxx.xxx	predictive	High
25	File	xxxxx.xxx	predictive	Medium
26	File	xxxxxxxx.x	predictive	Medium
27	File	xxxxxxxxx.xxx	predictive	High
28	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
29	File	xx.xxx	predictive	Low
30	File	xxxxxxxx.xxx	predictive	Medium
31	File	xxxx.xxx	predictive	Medium
32	File	xx_xxxxxx.xxx	predictive	High
33	File	xxxx/xx/xxxxxxxxx/xxxxxxxxxxxxxxxxxx.xxx	predictive	High
34	File	xxxxx.xxx	predictive	Medium
35	File	xxx/xxxxxx/xxxxxx.x	predictive	High
36	File	xxxx.xxx	predictive	Medium
37	File	xxxxxxxx.xxx	predictive	Medium
38	File	xxxxxxxx.xxx	predictive	Medium
39	File	xx/xxxx/xxxxxxx.x	predictive	High
40	File	xx/xxx/xxx_xxxxxxxx.x	predictive	High
41	File	xxxxxx.xxx	predictive	Medium
42	File	xxxxxxxxxx.xxx	predictive	High
43	File	xx_xxx.xxx	predictive	Medium
44	File	xxx/xxxxxx.xxx	predictive	High
45	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
46	File	xxxxx.xxx	predictive	Medium
47	File	xxxxxxxxxxxxx.xxx	predictive	High
48	File	xx/xxx/xxxxx.xxx	predictive	High
49	File	xxxxxx.x	predictive	Medium
50	File	xxxxxx/xxxxx.x	predictive	High
51	File	xxxxxxxxxx.xxx	predictive	High
52	File	xxxxx.xxx	predictive	Medium
53	File	xxxxx.xxx	predictive	Medium
54	File	xxxxxxxxxx/xxxxxxx.x	predictive	High
55	File	xxxx-xxxxxx.x	predictive	High
56	File	xxxxxxxx.xxx	predictive	Medium
57	File	xxx/xxxxxx.x	predictive	Medium
58	File	xxx.xxx	predictive	Low
59	File	xxxxxx.x	predictive	Medium
60	File	xxxxxxxx.xxx	predictive	Medium
61	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	High
62	File	xxxxxxxx.xxx	predictive	Medium
63	File	xxxxxxxx.xxx	predictive	Medium
64	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	High
65	File	xxxxxxxxx/xxxxxxx/xxxx/xxxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
66	File	xx_xxxx.xx	predictive	Medium
67	File	xxxxxxxx.xxx	predictive	Medium
68	File	xxxxxxx.xxx	predictive	Medium
69	File	xxxxx.xxx	predictive	Medium
70	File	xxxx-xxxxxx.x	predictive	High
71	File	xxxx_xxxxxx_xxxxxx.xxx	predictive	High
72	File	xxxxxx.xx	predictive	Medium
73	File	xxx/xxxxxxxx/xxxx_xxxxxx.x	predictive	High
74	File	xxxxxx.xxx	predictive	Medium
75	File	xxxxxx/xxxxxxx/xxxxxx/xxxxxxxx.xxx	predictive	High
76	File	xxxxxx/xxxxxxx/xx-xx/xxxx/xxxxx.xxx	predictive	High
77	File	xxxxxx/xxxxxxxxx/xxxxxxx.x	predictive	High
78	File	xxxx-xxxxx.xxx	predictive	High
79	File	xxxx-xxxxxxxx.xxx	predictive	High
80	File	xxxxxxxx.xxx	predictive	Medium
81	File	xxx.xxx	predictive	Low
82	File	xxxxx/xxxxxxxx.xxx	predictive	High
83	File	xxxxxxx.xxx	predictive	Medium
84	File	xxxxxxx.xxx	predictive	Medium
85	File	xxxxxx.xxx	predictive	Medium
86	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	High
87	File	xx-xxxxx/xxxxx.xxx	predictive	High
88	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
89	File	xx-xxxxxxxx/xxxxx.xxx	predictive	High
90	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxx.xxx	predictive	High
91	Library	/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxx/xxxxx.xxx	predictive	High
92	Library	xxxxxxxxxxx.xxx	predictive	High
93	Library	xxxxxxxxx/xxx-xxxxxx/xxxxxxxx.xxx	predictive	High
94	Library	xxxxxxxx.xxx	predictive	Medium
95	Library	xxxxxxxxxxx.xxx	predictive	High
96	Library	xxxxx.xxx	predictive	Medium
97	Library	xxxxxxxxxxxxxxxx.xxx	predictive	High
98	Library	xxx.xxx	predictive	Low
99	Library	xxxxxxx.xxx	predictive	Medium
100	Library	xxxxxxx.xxx	predictive	Medium
101	Library	xxxxxx.xxx	predictive	Medium
102	Library	xxx xxxxxxxxx	predictive	High
103	Library	xxxxxx/x/xxxxxxxx	predictive	High
104	Argument	$_xxx['xxxx']	predictive	High
105	Argument	-x	predictive	Low
106	Argument	xxxxxxxxxx	predictive	Medium
107	Argument	xxx	predictive	Low
108	Argument	xxxxxxxxxxxxxx	predictive	High
109	Argument	xxxxxxxx	predictive	Medium
110	Argument	xxxxxx	predictive	Low
111	Argument	xxxxxxx_xx	predictive	Medium
112	Argument	xxxxxxxxxx	predictive	Medium
113	Argument	xxxxxxx_xxxxx	predictive	High
114	Argument	xxxxxxxxxxx	predictive	Medium
115	Argument	xxxxxx	predictive	Low
116	Argument	xxxx/xxxx	predictive	Medium
117	Argument	xxxxxxxxxxxxx	predictive	High
118	Argument	xxxxx	predictive	Low
119	Argument	xxxx	predictive	Low
120	Argument	xxxxxxxx	predictive	Medium
121	Argument	xxxxxxxx	predictive	Medium
122	Argument	xxxx:	predictive	Low
123	Argument	xx	predictive	Low
124	Argument	xx	predictive	Low
125	Argument	xxxxxxxxx	predictive	Medium
126	Argument	xx	predictive	Low
127	Argument	xxxx_xx	predictive	Low
128	Argument	xxxxx[xxxxxxx]	predictive	High
129	Argument	xxxx	predictive	Low
130	Argument	xxxxxxxxxxx	predictive	Medium
131	Argument	xxx	predictive	Low
132	Argument	xxxxx/xxxx	predictive	Medium
133	Argument	xxxxxxx/xxxxx	predictive	High
134	Argument	xxxxxx	predictive	Low
135	Argument	xxxx_xxx	predictive	Medium
136	Argument	xxxxxx_xxxx	predictive	Medium
137	Argument	xxxxxxx xxxxxx	predictive	High
138	Argument	xxx_xx	predictive	Low
139	Argument	xxxx_xxxx	predictive	Medium
140	Argument	xxxxxxxxxx	predictive	Medium
141	Argument	xxxxxx	predictive	Low
142	Argument	xxxxxxxxxx	predictive	Medium
143	Argument	xxxxxx_xx	predictive	Medium
144	Argument	xxxxxxxx	predictive	Medium
145	Argument	xxx	predictive	Low
146	Argument	xxxxxxxxxx	predictive	Medium
147	Argument	xxx	predictive	Low
148	Argument	xxxxxxxxxx	predictive	Medium
149	Argument	xxxxxxxxxxx	predictive	Medium
150	Argument	xxxxxx xxxxxx	predictive	High
151	Argument	xxx	predictive	Low
152	Argument	xxx	predictive	Low
153	Argument	xxxx-xxxxxxxx	predictive	High
154	Argument	xxxxxxxx/xxxx	predictive	High
155	Argument	xxxx	predictive	Low
156	Argument	xxxxx/xxxxx/xxxxx/xxxx/xxxxxx	predictive	High
157	Input Value	%xxxxxx+-x+x+xx.x.xx.xxx%xx%xx	predictive	High
158	Input Value	../../	predictive	Low
159	Input Value	/xxxxxx/..%xx	predictive	High
160	Input Value	::$xxxxx_xxxxxxxxxx	predictive	High
161	Input Value	xxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxx	predictive	High
162	Input Value	xxxxxx	predictive	Low
163	Pattern	+\|xx xx xx xx xx xx xx\|	predictive	High
164	Pattern	/xxxxx/xxxxxxx.xxx	predictive	High
165	Pattern	/xxxxxxxxxx/	predictive	Medium
166	Pattern	xxxx\|xx\|	predictive	Medium
167	Pattern	xxxx	predictive	Low
168	Pattern	xxx	predictive	Low
169	Pattern	xxxxxxxxxxx	predictive	Medium
170	Pattern	xxxxxxx\|xx xx xx xx xx\|	predictive	High
171	Pattern	xxxx	predictive	Low
172	Pattern	xxxx	predictive	Low
173	Pattern	xxxxxxxxx\|xx\|	predictive	High
174	Pattern	xxxx	predictive	Low
175	Pattern	x\|xx\|x\|xx\|_\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|	predictive	High
176	Pattern	xxxxxx.xxxxxx	predictive	High
177	Pattern	xxxxx/xxxxxxxxx	predictive	High
178	Pattern	\|xx xx xx xx\|	predictive	High
179	Pattern	\|xx xx\|	predictive	Low
180	Pattern	\|xx xx xx xx\|<\|xx xx xx\|xxxx	predictive	High
181	Pattern	\|xx\|x\|xx xx\|	predictive	Medium
182	Network Port	xxx/xx	predictive	Low
183	Network Port	xxx/xxxx (xxx)	predictive	High
184	Network Port	xxx xxxxxx xxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!