Bahamut Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (12)

Sprache

en	6
de	6

Land

us	12

Akteure

Bahamut	1

Interesse

Typ

Hosting Control Software	4
Not Defined	4
Multimedia Player Software	2
Router Operating System	2

Hersteller

Parallels	4
EdgeMAX	4
NullSoft	2
Cisco	2

Produkt

Parallels Plesk Panel	4
EdgeMAX EdgeSwitch	4
NullSoft WinAmp	2
Cisco Linksys EA2700	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	EPSS	CTI	CVE
1	EdgeMAX EdgeSwitch erweiterte Rechte	8.0	7.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00123	0.02	CVE-2019-5446
2	EdgeMAX EdgeSwitch HTTP Interface erweiterte Rechte	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00402	0.04	CVE-2020-8233
3	Parallels Plesk Panel Administration Panel login_up.php3 Information Disclosure	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00302	0.00	CVE-2011-4728
4	Parallels Plesk Panel Control Panel login_up.php3 schwache Verschlüsselung	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00226	0.00	CVE-2011-4736
5	SPIP spip_pass.php3 Cross Site Scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
6	MyPhPim Login Page calendar.php3 SQL Injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.19924	0.00	CVE-2006-0167
7	Phpheaven PHPMyChat start_page.css.php3 Cross Site Scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00263	0.00	CVE-2005-1619
8	NullSoft WinAmp FLV File Pufferüberlauf	6.8	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00044	0.00	CVE-2017-10725
9	Cisco Linksys EA2700 URL Information Disclosure	4.3	4.1	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.00
10	Dating Script see_more_details.php SQL Injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.03
11	Itech Dating Script see_more_details.php SQL Injection	7.5	7.2	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00459	0.07	CVE-2017-20135
12	Maran PHP Shop prod.php SQL Injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00137	0.05	CVE-2008-4879

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Identifiziert	Typ	Akzeptanz
1	104.21.10.79		Bahamut	05.03.2024	verifiziert	High
2	XXX.XXX.XXX.XXX	xxx-xxxxxxxxx-x.xxx-xxx.xxx	Xxxxxxx	11.12.2023	verifiziert	High
3	XXX.XXX.XXX.XXX	xxx-xxxxxxxxx-x.xxx-xxx.xxx	Xxxxxxx	30.01.2024	verifiziert	High
4	XXX.XX.XXX.XX		Xxxxxxx	05.03.2024	verifiziert	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klassifizierung	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	prädiktiv	High
2	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	prädiktiv	High
3	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
4	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High
5	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	prädiktiv	High

IOA - Indicator of Attack (10)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/see_more_details.php	prädiktiv	High
2	File	calendar.php3	prädiktiv	High
3	File	xxxxx_xx.xxxx	prädiktiv	High
4	File	xxxx.xxx	prädiktiv	Medium
5	File	xxxx_xxxx.xxxx	prädiktiv	High
6	File	xxxxx_xxxx.xxx.xxxx	prädiktiv	High
7	Argument	xxx_xx	prädiktiv	Low
8	Argument	xxx	prädiktiv	Low
9	Argument	xxxxxxxx	prädiktiv	Medium
10	Argument	xx	prädiktiv	Low

Referenzen (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Interested in the pricing of exploits?

See the underground prices here!