SparklingGoblin Analysisinfo

IOB - Indicator of Behavior (24)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en14
pl2
sv2
de2
es2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

GitLab Community Edition2
GitLab Enterprise Edition2
Apache HTTP Server2
Microsoft Power BI Report Server2
RoundCube Webmail2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#VulnerabilityBaseTemp0dayTodayExpCouKEVEPSSCTICVE
1SSH SSH-1 Protocol cryptographic issues7.37.0$0-$5k$0-$5kNot definedOfficial fix 0.042720.02CVE-2001-1473
2axios Relative URL server-side request forgery5.75.7$0-$5k$0-$5kNot definedNot defined 0.000380.00CVE-2024-39338
3Microsoft Exchange Server privilege escalation8.88.1$25k-$100k$5k-$25kUnprovenOfficial fixpossible0.530440.04CVE-2023-32031
4IBM WebSphere Application Server Sequence code injection9.29.1$25k-$100k$5k-$25kNot definedOfficial fix 0.001880.02CVE-2023-23477
5EmpireCMS AdClass.php sql injection6.36.3$0-$5k$0-$5kNot definedNot defined 0.002330.02CVE-2022-28585
6Veritas NetBackup denial of service6.96.9$0-$5k$0-$5kNot definedNot defined 0.002590.00CVE-2022-36984
7Geeklog Media Gallery ftpmedia.php file inclusion7.36.9$0-$5k$0-$5kProof-of-ConceptNot defined 0.044180.09CVE-2007-2706
8Qt-cute QuickTalk guestbook qtg_msg_view.php sql injection7.37.1$0-$5k$0-$5kHighUnavailable 0.003970.00CVE-2007-3538
9GitLab Community Edition/Enterprise Edition ipynb File cross site scripting6.16.1$0-$5k$0-$5kNot definedNot defined 0.019500.00CVE-2021-39906
10Microsoft Power BI Report Server privilege escalation7.06.1$5k-$25k$0-$5kUnprovenOfficial fix 0.023270.09CVE-2021-31984
11Laravel Image Upload ValidatesAttributes.php unrestricted upload5.55.0$0-$5k$0-$5kProof-of-ConceptOfficial fixpossible0.477700.05CVE-2021-43617
12Apache HTTP Server mod_rewrite redirect6.76.7$5k-$25k$5k-$25kNot definedNot defined 0.154890.05CVE-2020-1927
13Request Tracker File Upload cross site scripting5.24.9$0-$5k$0-$5kNot definedOfficial fix 0.003240.00CVE-2016-6127
14RoundCube Webmail Password Plugin access control7.57.4$0-$5k$0-$5kNot definedOfficial fix 0.015600.00CVE-2017-8114
15Gallarific PHP Photo Gallery script gallery.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot defined 0.001100.04CVE-2011-0519
16SoftEther VPN Server See.sys Kernel 7pk security6.56.5$0-$5k$0-$5kNot definedNot defined 0.001280.06CVE-2019-11868
17Typecho write-post.php cross site scripting4.44.4$0-$5k$0-$5kNot definedNot defined 0.002060.00CVE-2017-16230
18D-Link DNS-345 Cookie improper authentication8.58.4$5k-$25k$0-$5kNot definedOfficial fix 0.019570.00CVE-2014-7857
19Zoho ManageEngine ServiceDesk Plus FileDownload.jsp path traversal5.35.0$0-$5k$0-$5kProof-of-ConceptNot defined 0.021670.00CVE-2011-2757
20Wired Community Software WWWThreads register.php sql injection6.56.2$0-$5k$0-$5kProof-of-ConceptUnavailable 0.004960.06CVE-2006-1958

Campaigns (1)

These are the campaigns that can be associated with the actor:

  • SideWalk

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
166.42.103.22266.42.103.222.vultrusercontent.comSparklingGoblin10/05/2022verifiedMedium
2XX.XX.XXX.XXxxxx.xxxxxx.xx.x.xxxxx.xxxXxxxxxxxxxxxxxxXxxxxxxx03/05/2022verifiedVery Low
3XXX.XX.XX.XXXXxxxxxxxxxxxxxxXxxxxxxx03/05/2022verifiedLow
4XXX.XX.X.XXXxxxxxxxxxxxxxx10/05/2022verifiedMedium
5XXX.XX.XX.XXXxxxx-xxxxxxxxxx.xxxxxxx.xxXxxxxxxxxxxxxxxXxxxxxxx03/05/2022verifiedLow

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (18)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1FileAdClass.phppredictiveMedium
2Fileadmin/write-post.phppredictiveHigh
3FileFileDownload.jsppredictiveHigh
4Filexxxxxxx.xxxpredictiveMedium
5Filexxxxxxxxxx/xxxxxxxxxx/xxxxxxxx/xxxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
6Filexxxxx/xxxxxxxx.xxxpredictiveHigh
7Filexxx_xxx_xxxx.xxxpredictiveHigh
8Filexxxxxxxx.xxxpredictiveMedium
9Filexxxx.xxxpredictiveMedium
10Filexxxx-xxxxxxxx.xxxpredictiveHigh
11Libraryxxx.xxxpredictiveLow
12ArgumentxxxpredictiveLow
13ArgumentxxxxxxxxpredictiveMedium
14ArgumentxxpredictiveLow
15ArgumentxxxxxxxxpredictiveMedium
16ArgumentxxxxxxpredictiveLow
17ArgumentxxxxxpredictiveLow
18Argument_xx_xxxx[xxxx_xxxx]predictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

This view requires CTI permissions

Just purchase a CTI license today!