Sarwent Analyse

IOB - Indicator of Behavior (18)

Zeitverlauf

Sprache

en16
ru2

Land

us16
ua2

Akteure

Aktivitäten

Interesse

Zeitverlauf

Typ

Hersteller

Produkt

Dahua IPC-HDW1X2X10
Dahua IPC-HFW1X2X10
Dahua IPC-HDW2X2X10
Dahua IPC-HFW2X2X10
Dahua IPC-HDW4X2X10

Schwachstellen

#SchwachstelleBaseTemp0dayHeuteAusMasCTIEPSSCVE
1Dahua IP Camera erweiterte Rechte7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.030.00101CVE-2017-7253
2eSyndicat Directory Software suggest-listing.php Cross Site Scripting3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.030.00000
3Reolink RLC-410W Firmware Update Privilege Escalation5.55.3$0-$5k$0-$5kNot DefinedNot Defined0.030.00149CVE-2021-40419
4Dahua IPC-HDBW2XXX/IPC-HFW2XXX/ASI7XXXX ONVIF schwache Authentisierung7.87.6$0-$5k$0-$5kNot DefinedOfficial Fix0.010.00135CVE-2022-30563
5Dahua DH-IPC-Hxxxxxxxxx Authentication schwache Authentisierung7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.000.03148CVE-2017-7927
6Dahua IPC-HDW1X2X IP Address Information Disclosure5.35.1$0-$5kWird berechnetNot DefinedOfficial Fix0.030.00084CVE-2019-9680
7Dahua IPC-HDW1X2X Login erweiterte Rechte6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00103CVE-2019-9678
8Dahua IPC-HDW1X2X Debug Function erweiterte Rechte7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00104CVE-2019-9679
9Dahua IPC-HDW1X2X Online Upgrade Reverse Engineering Information Disclosure5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00084CVE-2019-9681
10Dahua IPC-HDW1X2X CGI Interface Pufferüberlauf8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00250CVE-2019-9677
11Dahua DHI-HCVR7216A-S3 MD5 erweiterte Rechte5.95.9$0-$5k$0-$5kNot DefinedNot Defined0.020.31255CVE-2017-6343
12TP-Link TL-WR841N V13 Traceroute erweiterte Rechte7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00770CVE-2020-35576
13PCCS-Linux MySQLDatabase Admin Tool dbconnect.inc Password Information Disclosure7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00696CVE-2000-0707
14Red Hat Linux nfs-utils rpc.statd Format String9.88.8$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.030.08052CVE-2000-0666
15SonicWall SSLVPN SMA100 SQL Injection7.37.1$0-$5k$0-$5kFunctionalNot Defined0.020.02628CVE-2021-20016

Kampagnen (1)

These are the campaigns that can be associated with the actor:

  • Amnesty International and Pegasus

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-AdresseHostnameAkteurKampagnenIdentifiziertTypAkzeptanz
187.249.53.124713697-cj66716.tmweb.ruSarwentAmnesty International and Pegasus30.09.2021verifiziertHigh
2XXX.XXX.XXX.XXXxxxxxxXxxxxxx Xxxxxxxxxxxxx Xxx Xxxxxxx30.09.2021verifiziertHigh
3XXX.X.XX.XXXxxxx.xxxxxx.xxxxxxxXxxxxxxXxxxxxx Xxxxxxxxxxxxx Xxx Xxxxxxx30.09.2021verifiziertHigh

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueSchwachstellenZugriffsartTypAkzeptanz
1T1040CWE-294Authentication Bypass by Capture-replayprädiktivHigh
2T1059.007CWE-80Cross Site ScriptingprädiktivHigh
3TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxprädiktivHigh
4TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxprädiktivHigh
5TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxprädiktivHigh
6TXXXXCWE-XXXXxxxxxxxxx XxxxxxprädiktivHigh
7TXXXXCWE-XXXxx XxxxxxxxxprädiktivHigh
8TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxprädiktivHigh

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasseIndicatorTypAkzeptanz
1Filedbconnect.incprädiktivHigh
2Filexxx.xxxxxprädiktivMedium
3Filexxxxxxx-xxxxxxx.xxxprädiktivHigh
4ArgumentxxxxxprädiktivLow

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!