TunnelVision Analysis

IOB - Indicator of Behavior (44)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	40
pl	2
fr	2

Country

us	30
mx	10
gb	4

Actors

TunnelVision	5
Mint Sandstorm	2
IcedID	1

Activities

Interest

Timeline

Type

Not Defined	8
Operating System	4
Groupware Software	4
Content Management System	4
Log Management Software	2

Vendor

Not Defined	10
Microsoft	6
Itechscripts	2
YITH	2
McAfee	2

Product

Itechscripts iTechBids	2
PbootCMS	2
Cacti	2
Microsoft Windows	2
YITH WooCommerce Gift Cards Premium Plugin	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.04	0.01621	CVE-2007-1192
2	SAP NetWeaver MigrationService improper authorization	9.2	9.2	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00068	CVE-2021-21481
3	WordPress cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.01034	CVE-2022-21662
4	WordPress WP_Query sql injection	6.3	6.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.92907	CVE-2022-21661
5	Microsoft Windows RDP authorization	8.8	7.7	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.03	0.00129	CVE-2021-1669
6	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	2.69	0.00954	CVE-2010-0966
7	Cacti Request Parameter remote_agent.php injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.14	0.97186	CVE-2022-46169
8	All in One SEO Plugin REST API Endpoint access control	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00730	CVE-2021-25036
9	YITH WooCommerce Gift Cards Premium Plugin Shopping Cart php unrestricted upload	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03	0.07359	CVE-2021-3120
10	WordPress wp-publications Plugin Archive bibtexbrowser.php path traversal	7.8	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00476	CVE-2021-38360
11	WP Import Export Plugin class-wpie-general.php wpie_process_file_download authorization	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.00129	CVE-2022-0236
12	Cisco Small Business RV345 stack-based overflow	9.9	9.7	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.03	0.94468	CVE-2022-20699
13	WordPress Object injection	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00192	CVE-2022-21663
14	Oracle GlassFish Open Source Edition Demo Feature hard-coded credentials	8.5	8.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.08	0.00270	CVE-2018-14324
15	Microsoft Exchange Server Privilege Escalation	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.03	0.95439	CVE-2021-42321
16	F5 BIG-IP TMUI Privilege Escalation	8.8	8.4	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.01	0.00152	CVE-2021-22988
17	Microsoft SharePoint Server Privilege Escalation	8.8	7.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.01	0.19278	CVE-2021-31181
18	Umbraco CMS Installation path traversal	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00219	CVE-2020-5811
19	Dnsmasq information disclosure	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00331	CVE-2019-14834
20	Smartstore WebApi Authentication improper authentication	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00280	CVE-2020-15243

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	51.89.135.142	ip142.ip-51-89-135.eu	TunnelVision	02/25/2022	verified	High
2	51.89.169.198	ip198.ip-51-89-169.eu	TunnelVision	02/25/2022	verified	High
3	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxxxxxxxxxxx	02/25/2022	verified	High
4	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxxxxxxxxxxx	02/25/2022	verified	High
5	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xxx	Xxxxxxxxxxxx	02/25/2022	verified	High
6	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xxx	Xxxxxxxxxxxx	02/25/2022	verified	High
7	XXX.XX.XXX.X		Xxxxxxxxxxxx	02/25/2022	verified	High

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22	Pathname Traversal	predictive	High
2	T1055	CWE-74	Injection	predictive	High
3	TXXXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxx Xxxxxxxxxxx Xxx Xxx Xxxxxxx	predictive	High
6	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
9	TXXXX	CWE-XXX	Xxxxxxxxxxxxx	predictive	High
10	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (30)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/cgi-bin/user/Config.cgi	predictive	High
2	File	/etc/sudoers	predictive	Medium
3	File	admin.php/User/del/ucode/	predictive	High
4	File	data/gbconfiguration.dat	predictive	High
5	File	xxxxxx.xxx	predictive	Medium
6	File	xxx/xxxxxx.xxx	predictive	High
7	File	xxxxx_xxx.xxx	predictive	High
8	File	xxx	predictive	Low
9	File	xxxx.xxx	predictive	Medium
10	File	xxxxxxxxx.xxx	predictive	High
11	File	xxxxxx_xxxxx.xxx	predictive	High
12	File	xxxx.xxx	predictive	Medium
13	File	xxxxxx/xxxxx.xxx/xxxx/xxxx	predictive	High
14	File	xxxxxxxxx.xxx	predictive	High
15	File	xxxxxx/xxxxx/xxxx_xxx.xxx	predictive	High
16	File	~/xxxxxxxxxxxxx.xxx	predictive	High
17	File	~/xxxxxxxx/xxxxxxx/xxxxx-xxxx-xxxxxxx.xxx	predictive	High
18	Argument	xxxxxxxx	predictive	Medium
19	Argument	xxx	predictive	Low
20	Argument	xxxx/xxxxxxx	predictive	Medium
21	Argument	xxxx_xx	predictive	Low
22	Argument	xxxxxxxx	predictive	Medium
23	Argument	xxxx	predictive	Low
24	Argument	xxxxxxx	predictive	Low
25	Argument	x_xxxx	predictive	Low
26	Argument	xxxxx_xx	predictive	Medium
27	Argument	xxxxxxxx	predictive	Medium
28	Input Value	xxxxxx=xxx&xxxxxxxx=xxxxxxx.*	predictive	High
29	Input Value	xxxxx	predictive	Low
30	Input Value	xxxxxxxxx xxxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!