APT17 تحليل

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (244)

اللغة

en	212
ja	16
zh	10
es	4
it	2

البلد

us	104
de	82
cn	30
jp	18
it	2

الفاعلين

APT17	9
Cobalt Strike	3
FunnySwitch	2
Sandworm Team	1
TAG-53	1

الاهتمام

النوع

Not Defined	36
Content Management System	16
Router Operating System	6
Operating System	6
Network Attached Storage Software	4

المجهز

Not Defined	42
QNAP	4
Cisco	4
Fortinet	4
Microsoft	4

منتج

WordPress	10
WeiPHP	4
QNAP QTS	4
Fortinet FortiOS	4
Fortinet FortiProxy	4

الثغرات

#	الثغرة	Base	Temp	0day	اليوم	ق�	معالجة	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php تجاوز الصلاحيات	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.75	CVE-2010-0966
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash الكشف عن المعلومات	5.3	5.2	$5k-$25k	جاري الحساب	High	Workaround	0.02016	0.00	CVE-2007-1192
3	jforum User تجاوز الصلاحيات	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.04	CVE-2019-7550
4	ESET Server Security for Linux تجاوز الصلاحيات	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.06	CVE-2023-2847
5	CrowdStrike Falcon Uninstallation تجاوز الصلاحيات	3.5	3.5	$0-$5k	$0-$5k	Functional	Official Fix	0.01290	0.18	CVE-2022-2841
6	Postfix Admin functions.inc.php حقن إس كيو إل	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.00253	0.03	CVE-2014-2655
7	SourceCodester Complaint Management System Lodge Complaint Section register-complaint.php تجاوز الصلاحيات	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	1.19	CVE-2024-1875
8	OPNsense تجاوز الصلاحيات	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00122	0.04	CVE-2023-39008
9	Fortinet FortiOS/FortiProxy HA Request تجاوز الصلاحيات	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00050	0.04	CVE-2023-44250
10	jQuery Cookie Prototype سكربتات مشتركة	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00068	0.05	CVE-2022-23395
11	Flexera FlexNet Publisher Command lmadmin.exe تجاوز الصلاحيات	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00103	0.00	CVE-2019-8960
12	ESET NOD32 Antivirus File تجاوز الصلاحيات	7.8	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.00	CVE-2023-3160
13	Citrix StoreFront SAML Authentication سكربتات مشتركة	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00072	0.00	CVE-2022-27503
14	QNAP QTS/QuTS hero/QuTScloud تجاوز الصلاحيات	9.8	9.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00068	0.02	CVE-2023-23368
15	cURL SOCKS5 Proxy تلف الذاكرة	4.6	4.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00319	0.02	CVE-2023-38545
16	Fortinet FortiOS prof-admin Profile تجاوز الصلاحيات	7.7	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00050	0.03	CVE-2023-41841
17	Juniper Junos OS J-Web ثغرات غير معروفة	5.3	5.2	$5k-$25k	$0-$5k	High	Official Fix	0.96663	0.04	CVE-2023-36845
18	QNAP QTS/QuTS Hero تشفير ضعيف	4.6	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00052	0.00	CVE-2023-34972
19	Hitachi Energy TXpert Hub CoreTec 4 تجاوز الصلاحيات	8.3	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00043	0.00	CVE-2023-2625
20	Trend Micro Apex One/Apex One as a Service Management Server اجتياز الدليل	8.5	8.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00215	0.00	CVE-2023-32557

حملات (1)

These are the campaigns that can be associated with the actor:

CCleaner

IOC - Indicator of Compromise (21)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	عنوان بروتوكول الإنترنت	Hostname	ممثل	حملات	Identified	النوع	الثقة
1	1.234.52.111		APT17		15/12/2020	verified	عالي
2	8.9.11.130	8.9.11.130.vultr.com	APT17		05/03/2022	verified	متوسط
3	45.76.6.149	45.76.6.149.vultr.com	APT17		05/03/2022	verified	متوسط
4	45.76.31.159	45.76.31.159.vultr.com	APT17		05/03/2022	verified	متوسط
5	69.80.72.165		APT17		15/12/2020	verified	عالي
6	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxx.xxxxxxxx.xxx	Xxxxx		05/03/2022	verified	عالي
7	XXX.XXX.XX.XX	xxxxxxxxxx.xxxxx.xx	Xxxxx		15/12/2020	verified	عالي
8	XXX.XXX.XX.XXX	xxxxxxxxxxxxxx.xxxxx.xx	Xxxxx		15/12/2020	verified	عالي
9	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxx		05/03/2022	verified	عالي
10	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxx.xxx	Xxxxx		05/03/2022	verified	متوسط
11	XXX.XX.XXX.XX		Xxxxx		15/12/2020	verified	عالي
12	XXX.XXX.XX.XXX	xxxxxxx.xxxxxxxx.xx.xx-xxx.xx.xx	Xxxxx		15/12/2020	verified	عالي
13	XXX.XXX.XXX.XXX		Xxxxx		05/03/2022	verified	عالي
14	XXX.XXX.XXX.XX		Xxxxx		15/12/2020	verified	عالي
15	XXX.XXX.XX.XX	xxxxxxx.xxxx.xx	Xxxxx		15/12/2020	verified	عالي
16	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxx.xxx	Xxxxx		05/03/2022	verified	متوسط
17	XXX.XX.XX.XX	xxx.xx.xx.xx.xxxxx.xxx	Xxxxx		05/03/2022	verified	متوسط
18	XXX.XXX.XXX.XXX		Xxxxx		15/12/2020	verified	عالي
19	XXX.XX.XX.XXX		Xxxxx		15/12/2020	verified	عالي
20	XXX.XXX.XXX.XXX		Xxxxx	Xxxxxxxx	23/12/2020	verified	عالي
21	XXX.XXX.XXX.XX		Xxxxx		15/12/2020	verified	عالي

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	الفئة	الثغرات	متجه الوصول	النوع	الثقة
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	عالي
2	T1040	CAPEC-102	CWE-319	Authentication Bypass by Capture-replay	predictive	عالي
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	عالي
4	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	عالي
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	عالي
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	عالي
7	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx-xxx Xxxx Xxxxxxx Xxxx	predictive	عالي
8	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	عالي
9	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	عالي
10	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	عالي
11	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	عالي
12	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	عالي
13	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	عالي
14	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	عالي
15	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	عالي
16	TXXXX.XXX	CAPEC-459	CWE-XXX, CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	عالي
17	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	عالي
18	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	عالي
19	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	عالي

IOA - Indicator of Attack (56)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	الفئة	Indicator	النوع	الثقة
1	File	.htaccess	predictive	متوسط
2	File	/api/cron/settings/setJob/	predictive	عالي
3	File	/api/DownloadUrlResponse.ashx	predictive	عالي
4	File	/wbg/core/_includes/authorization.inc.php	predictive	عالي
5	File	addentry.php	predictive	متوسط
6	File	data/gbconfiguration.dat	predictive	عالي
7	File	detail.php	predictive	متوسط
8	File	xxxxxxxxx.xxx.xxx	predictive	عالي
9	File	xxxxxx/xxxxxxxxxxxx	predictive	عالي
10	File	xxxx.xxx	predictive	متوسط
11	File	xxxxxxxxx.xxx	predictive	عالي
12	File	xxx/xxxxxx.xxx	predictive	عالي
13	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	عالي
14	File	xxxxxxxxxx/xxxxxxx.x	predictive	عالي
15	File	xxxxxxx.xxx	predictive	متوسط
16	File	xxxxxxx.xxx	predictive	متوسط
17	File	xxx_xx_xx_xxxxxxxx.xxx	predictive	عالي
18	File	xxxxx.xxx	predictive	متوسط
19	File	xxxxx-xxxx/xxxxx-xxxxx-xxxx.xxx	predictive	عالي
20	File	xxxxxxxx.xxx	predictive	متوسط
21	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	عالي
22	File	xxxx.x	predictive	واطئ
23	File	xxx/xxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	عالي
24	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	عالي
25	File	xxxxxxxx.xxxxx.xxx	predictive	عالي
26	File	xxxxx.xxx	predictive	متوسط
27	File	xxxxxxx/xxxxxxxx.xxx	predictive	عالي
28	File	xxxxx/xxxxxxxx-xxxxxxxxx.xxx	predictive	عالي
29	File	xxxxx.xxx	predictive	متوسط
30	File	xx-xxxxx/xxxxx.xxx	predictive	عالي
31	File	xx-xxxxx/xxxxx-xxxxxx.xxx	predictive	عالي
32	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	عالي
33	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	عالي
34	File	xx-xxxxx.xxx	predictive	متوسط
35	Library	xxxxxxxx.xxx	predictive	متوسط
36	Argument	xx_xxxxx_xxx_xxxx	predictive	عالي
37	Argument	xxxxxxxx	predictive	متوسط
38	Argument	xxxxxxxxxx	predictive	متوسط
39	Argument	xxxxxxx	predictive	واطئ
40	Argument	xxxx	predictive	واطئ
41	Argument	xxxx	predictive	واطئ
42	Argument	xxxx	predictive	واطئ
43	Argument	xxxx	predictive	واطئ
44	Argument	xxxx	predictive	واطئ
45	Argument	xxxx/xxxxxxxxxxx	predictive	عالي
46	Argument	xxxxx	predictive	واطئ
47	Argument	xxxxxxxxxx	predictive	متوسط
48	Argument	xxxx_xxxxx	predictive	متوسط
49	Argument	xxxxxxx	predictive	واطئ
50	Argument	xxxx_xx	predictive	واطئ
51	Argument	xxx	predictive	واطئ
52	Argument	xxx_xxxxx	predictive	متوسط
53	Argument	x_xxxx	predictive	واطئ
54	Argument	\xxxxxx\	predictive	متوسط
55	Argument	_xxx_xxxxxxxxxxx_	predictive	عالي
56	Input Value	../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxx	predictive	عالي

المصادر (4)

The following list contains external sources which discuss the actor and the associated activities:

التالي ▸نظرة عامة◂ السابق

Interested in the pricing of exploits?

See the underground prices here!