TeleBots Analysis

IOB - Indicator of Behavior (158)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en132
de14
it6
fr4
es2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

ch50
us42
nl12
ru10
ro8

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Linux Kernel8
WordPress8
ProFTPD4
NVIDIA Windows GPU Display Driver4
Stoverud PHPhotoalbum2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1Backdoor.Win32.Tiny.c Service Port 7778 backdoor7.36.4$0-$5k$0-$5kProof-of-ConceptWorkaround0.020.00000
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25k$0-$5kHighWorkaround0.040.04187CVE-2007-1192
3Linux Kernel NILFS File System inode.c security_inode_alloc use after free8.38.1$25k-$100k$5k-$25kNot DefinedOfficial Fix0.020.01404CVE-2022-2978
4Crow HTTP Pipelining use after free8.58.4$0-$5k$0-$5kNot DefinedOfficial Fix0.020.02509CVE-2022-38667
5mySCADA myPRO command injection9.29.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00885CVE-2022-2234
6GNU Bash Environment Variable variables.c Shellshock os command injection9.89.3$100k and more$0-$5kHighOfficial Fix0.020.96235CVE-2014-6271
7Microsoft Visual Studio xml external entity reference6.35.5$5k-$25k$0-$5kProof-of-ConceptUnavailable0.020.00000
8ProFTPD mod_copy access control8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.020.70009CVE-2019-12815
9OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial Fix0.110.49183CVE-2016-6210
10Zeus Zeus Web Server memory corruption10.09.0$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.020.35205CVE-2010-0359
11WordPress WP_Query class-wp-query.php sql injection8.58.4$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.020.01974CVE-2017-5611
12FreeBSD Ping pr_pack stack-based overflow7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.00000CVE-2022-23093
13Red Hat OpenShift server_priv.pem default permission4.54.5$5k-$25k$5k-$25kNot DefinedNot Defined0.030.00885CVE-2013-4281
14Linux Kernel NTFS3 Subsystem cleanup7.07.0$5k-$25k$5k-$25kNot DefinedNot Defined0.000.00885CVE-2022-3238
15SQLite ALTER TABLE memory corruption8.08.0$0-$5k$0-$5kNot DefinedNot Defined0.020.00885CVE-2020-35527
16md2roff Markdown File stack-based overflow7.67.6$0-$5k$0-$5kNot DefinedNot Defined0.030.00885CVE-2022-41220
17Nissan/Kia/Hyundai Vehicle Remote Keyless Entry RollBack improper authentication6.46.4$5k-$25k$5k-$25kProof-of-ConceptNot Defined0.000.01213CVE-2022-37418
18Citrix Gateway Plug-in privileges management8.88.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00885CVE-2022-21827
19Splunk Enterprise Command-Line Interface certificate validation6.26.1$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00954CVE-2022-32156
20Honeywell ControlEdge SSH hard-coded credentials9.89.6$0-$5k$0-$5kNot DefinedNot Defined0.030.01885CVE-2022-30318

Campaigns (1)

These are the campaigns that can be associated with the actor:

  • Ukraine

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1006CWE-22Pathname TraversalpredictiveHigh
2T1059CWE-94Cross Site ScriptingpredictiveHigh
3T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveHigh
4T1068CWE-264, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveHigh
5TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx XxxxxxxxpredictiveHigh
6TXXXXCWE-XX, CWE-XXXxxxxxx XxxxxxxxxpredictiveHigh
7TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveHigh
8TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveHigh
9TXXXXCWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveHigh
10TXXXXCWE-XXXXxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx XxxxxpredictiveHigh
11TXXXXCWE-XXXxx XxxxxxxxxpredictiveHigh
12TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
13TXXXX.XXXCWE-XXXXxxxxxxxpredictiveHigh
14TXXXXCWE-XXXXxxxxxxxxxxxxpredictiveHigh
15TXXXX.XXXCWE-XXXxxxxxxxxxxxxpredictiveHigh
16TXXXX.XXXCWE-XXXXxxxxxxxxxxx XxxxxxpredictiveHigh

IOA - Indicator of Attack (121)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File.htaccesspredictiveMedium
2File/cgi-bin/supervisor/PwdGrp.cgipredictiveHigh
3File/CMD_SELECT_USERSpredictiveHigh
4File/configs/application.inipredictiveHigh
5File/dashboard/updatelogo.phppredictiveHigh
6File/etc/openshift/server_priv.pempredictiveHigh
7File/index.phppredictiveMedium
8File/mkshop/Men/profile.phppredictiveHigh
9File/Noxen-master/users.phppredictiveHigh
10File/phppath/phppredictiveMedium
11File/uncpath/predictiveMedium
12Fileadmin-ajax.phppredictiveHigh
13Fileadmin/google_search_console/class-gsc-table.phppredictiveHigh
14Fileadmin/menus/edit.phppredictiveHigh
15Filealbum_portal.phppredictiveHigh
16Filexxxx/xxx/xxxxxx/xxxxx-xxxxx_xxxx.xpredictiveHigh
17Filexxxxxxxx.xxxpredictiveMedium
18Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
19Filexxxx\xx_xx.xxxpredictiveHigh
20Filexxxxxxx.xxxpredictiveMedium
21Filexx.xpredictiveLow
22Filexxxxx.xxxpredictiveMedium
23FilexxxxxxxxxxxxxxxxxxxpredictiveHigh
24Filexxxxxxxxxx/xxxxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
25Filexxxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxxpredictiveHigh
26Filexxxxxxxx/xxxxxxx.xxxpredictiveHigh
27Filexxxxxxxx/xxx/xxx_xx_xxxxxxx.xxxpredictiveHigh
28Filexxxxx.xxxpredictiveMedium
29Filexxxxx.xpredictiveLow
30Filexxxxxxxxxx.xxxpredictiveHigh
31Filexxxx_xxxx.xxxpredictiveHigh
32Filexxxxxx.xpredictiveMedium
33Filexx.xxxpredictiveLow
34Filexxxx.xxxpredictiveMedium
35Filexxxxx/x/xxx/xxxx.xxxpredictiveHigh
36Filexxxxxxxx.xxxxx.xxxpredictiveHigh
37Filexxxx.xxxpredictiveMedium
38Filexxxxxxxxxxxxx.xxxpredictiveHigh
39Filexxxxxxxxxxxxxx.xxxpredictiveHigh
40Filexxxxxxx_xxxx.xxxpredictiveHigh
41Filexxxxxxx.xxxpredictiveMedium
42Filexxxxx_xxxxxxx.xxxpredictiveHigh
43Filexxxxxx.xxxpredictiveMedium
44Filexxxxxx.xxxpredictiveMedium
45Filexxx/xxx_xxxpredictiveMedium
46Filexxxx.xxxpredictiveMedium
47Filexxxxxx.xpredictiveMedium
48Filexxxx.xxxpredictiveMedium
49Filexxxx_xxxx.xxxpredictiveHigh
50Filexxxxxxxxxxxxxxxx.xxpredictiveHigh
51Filexxxxxx-xxxxx-xxxxxx.xxxpredictiveHigh
52Filexxxxxxxx/xxxpredictiveMedium
53Filexxxxxx.xxxpredictiveMedium
54Filexxxxxx.xxxpredictiveMedium
55Filexxxx/xxx/xxxx-xxxxx.xxxpredictiveHigh
56Filexxxxxxxxx.xpredictiveMedium
57Filexxxxxxx.xxxpredictiveMedium
58Filexxxxxxx.xxxpredictiveMedium
59Filexxxx_xxx.xxxpredictiveMedium
60Filexxx/xxxxxx/xxxxxxxxxxxxx.xxxpredictiveHigh
61Filexx-xxxxxxx.xxxpredictiveHigh
62Filexx-xxxxxxxx/xxxxx-xx-xxxxxxxxx-xxxxxxx.xxxpredictiveHigh
63Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveHigh
64Filexx-xxxxxxxx/xxxx.xxxpredictiveHigh
65Filexx-xxxxxxxx.xxxpredictiveHigh
66Filexxxxxxxxxxxx.xxxpredictiveHigh
67Libraryxxx.xxxpredictiveLow
68Libraryxxxxxxxx.xxxpredictiveMedium
69ArgumentxxxxpredictiveLow
70ArgumentxxxxxxxxxpredictiveMedium
71Argumentxxxx_xxxpredictiveMedium
72ArgumentxxxpredictiveLow
73Argumentxxxx_xxpredictiveLow
74ArgumentxxxxxpredictiveLow
75ArgumentxxxpredictiveLow
76Argumentxxxx_xxpredictiveLow
77ArgumentxxxxxxxpredictiveLow
78ArgumentxxxxxxxxxxxpredictiveMedium
79ArgumentxxxxxxpredictiveLow
80Argumentxxxxxx_xxxx_xxxxxxxxpredictiveHigh
81ArgumentxxxxxxxxpredictiveMedium
82Argumentxxx_xxxx/xxx_xxxxxxxpredictiveHigh
83ArgumentxxxxxxxxxxxpredictiveMedium
84Argumentxxxx/xxxx_xxpredictiveMedium
85ArgumentxxxxxxxxxpredictiveMedium
86Argumentxxxx_xxxxxxxpredictiveMedium
87ArgumentxxpredictiveLow
88ArgumentxxxxxxxxxxpredictiveMedium
89ArgumentxxxpredictiveLow
90ArgumentxxxxpredictiveLow
91ArgumentxxxxxxxxpredictiveMedium
92Argumentxxxxxxxxxxxxx_xxpredictiveHigh
93Argumentxxx_xxpredictiveLow
94ArgumentxxxxxxpredictiveLow
95ArgumentxxxxxxpredictiveLow
96Argumentxxxxxx_xxxxpredictiveMedium
97ArgumentxxxxxxxxpredictiveMedium
98Argumentxxxxx_xxxx_xxxxpredictiveHigh
99ArgumentxxxxxxxxxpredictiveMedium
100ArgumentxxxxxxxxxpredictiveMedium
101ArgumentxxxxxxxxxpredictiveMedium
102Argumentxxxxxxxx_xxpredictiveMedium
103Argumentxxxxxxx_xxpredictiveMedium
104ArgumentxxxxxxpredictiveLow
105ArgumentxxxxxxxpredictiveLow
106ArgumentxxxxxxpredictiveLow
107ArgumentxxxxxxpredictiveLow
108ArgumentxxxxxxxxxpredictiveMedium
109Argumentxxxxx_xxpredictiveMedium
110Argumentxxxx_xxpredictiveLow
111Argumentxxxx_xxxxxpredictiveMedium
112Argumentx_xxxpredictiveLow
113Argumentx-xxxx-xxxxxpredictiveMedium
114Argumentxxxxx/xxxxxpredictiveMedium
115Input Value"><xxxxxx>xxxxx(/xxx/)</xxxxxx>predictiveHigh
116Input Value..predictiveLow
117Input Valuex" xxxxxxxxxxx=xxxxxx(xxxxxx) xxx="predictiveHigh
118Input Valuexxxxx' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx) xxx 'xxxx'='xxxx&xxxxxxxx=xxxxxxxxxxpredictiveHigh
119Input Valuexxx_xxx_xxxx_xxxx'"><xxxxxx>xxxxx(/xxxxx.xx/)</xxxxxx>predictiveHigh
120Pattern() {predictiveLow
121Network Portxxx/xxxxpredictiveMedium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!