Bublik Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (7)

Sprache

en	8

Land

ne	4
us	4

Akteure

Bublik	1

Interesse

Typ

Not Defined	2
Groupware Software	2
File Transfer Software	2

Hersteller

Saifor	2
Synacor	2
Not Defined	2

Produkt

Saifor CVMS HUB	2
Synacor Zimbra Collaboration Suite	2
ProFTPD	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	CTI	EPSS	CVE
1	Saifor CVMS HUB HTTP Parameter secciones.xhtml SQL Injection	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00087	CVE-2018-6792
2	Synacor Zimbra Collaboration Suite Header ProxyServlet.java erweiterte Rechte	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00732	CVE-2021-35209
3	Synacor Zimbra Collaboration Suite Calendar Invite ZmMailMsgView.js Cross Site Scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00155	CVE-2021-35208
4	Dropbear svr-auth.c recv_msg_userauth_request User Information Disclosure	5.3	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00302	CVE-2018-15599
5	ProFTPD mod_sftp/mod_sftp_pam kbdint.c resp_count Denial of Service	7.5	7.1	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.03	0.01980	CVE-2013-4359
6	Microsoft Windows Token Security Feature erweiterte Rechte	7.1	6.8	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00	0.00059	CVE-2020-0981

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Identifiziert	Typ	Akzeptanz
1	66.23.234.229	host.double-six.net	Bublik	28.06.2023	verifiziert	High
2	66.128.53.179		Bublik	22.07.2021	verifiziert	High
3	XX.XX.XX.XXX	xxxx.xxxxxx.xxx	Xxxxxx	28.06.2023	verifiziert	High
4	XXX.XX.XX.XXX		Xxxxxx	22.07.2021	verifiziert	High
5	XXX.XXX.XX.XX		Xxxxxx	05.05.2022	verifiziert	High
6	XXX.XXX.X.XX	xxxx-xxxx-xxxx-xxx-xx-xxxx.xxxxxxxx.xxx	Xxxxxx	22.07.2021	verifiziert	High
7	XXX.XXX.XXX.XX		Xxxxxx	28.04.2022	verifiziert	High
8	XXX.XX.XXX.XX	xxxxx.xx	Xxxxxx	22.07.2021	verifiziert	High
9	XXX.XX.XXX.XXX	x-xxxx.x-xxxxxx.xxx	Xxxxxx	05.05.2022	verifiziert	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	prädiktiv	High
2	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	prädiktiv	High
3	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
4	TXXXX	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
5	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High

IOA - Indicator of Attack (6)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/cvms-hub/privado/seccionesmib/secciones.xhtml	prädiktiv	High
2	File	kbdint.c	prädiktiv	Medium
3	File	xxxxxxxxxxxx.xxxx	prädiktiv	High
4	File	xxx-xxxx.x	prädiktiv	Medium
5	File	xxxxxxxxxxxxx.xx	prädiktiv	High
6	Argument	x-xxxx	prädiktiv	Low

Referenzen (6)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Do you need the next level of professionalism?

Upgrade your account now!