Bisonal Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (16)

Idioma

en	14
zh	2

País

cn	8
us	4
th	2
br	2

Actores

Bisonal	3

Interesar

Escribe

Not Defined	14
Content Management System	2

Proveedor

Not Defined	8
Bitrix	4
Tiki	2
Atlassian	2

Producto

Bitrix Site Manager	4
Bitrix	2
FLDS	2
INFINICART	2
CodeIgniter	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	Bitrix Site Manager redirect.php escalada de privilegios	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00113	0.03	CVE-2008-2052
2	FLDS redir.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.06	CVE-2008-5928
3	Idera Travis CI Activation .travis.yml divulgación de información	2.6	2.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00156	0.02	CVE-2021-41077
4	Autoptimize Plugin Import escalada de privilegios	5.4	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01016	0.00	CVE-2021-24376
5	Bitrix Upload from Local Disk Feature restore.php escalada de privilegios	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.00	CVE-2022-29268
6	Bitrix Site Manager Vote Module Remote Code Execution	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00668	0.00	CVE-2022-27228
7	SSH Agent Plugin escalada de privilegios	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.00	CVE-2022-20620
8	CodeIgniter Sendmail Email.php escalada de privilegios	8.5	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04920	0.04	CVE-2016-10131
9	Atlassian Bitbucket Data Center directory traversal	8.1	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00441	0.02	CVE-2019-3397
10	furlongm openvpn-monitor Management Interface Socket escalada de privilegios	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00120	0.00	CVE-2021-31605
11	VMware vCenter Server Analytics Service escalada de privilegios	8.6	8.5	$5k-$25k	$0-$5k	High	Official Fix	0.97389	0.07	CVE-2021-22005
12	WordPress HTML Element general-template.php cross site scripting	4.4	4.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00094	0.03	CVE-2017-17093
13	Linux Kernel UDP Packet udp.c escalada de privilegios	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04837	0.03	CVE-2016-10229
14	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgación de información	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
15	Tiki TikiWiki tiki-editpage.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01194	0.03	CVE-2004-1386
16	INFINICART browse_group.asp sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00262	0.00	CVE-2006-5957

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	0.0.0.0		Bisonal	2020-03-07	verified	Alto
2	61.90.202.197	61-90-202-197.static.asianet.co.th	Bisonal	2020-03-07	verified	Alto
3	XX.XX.XXX.XXX	xx-xx-xxx-xxx.xxxxxx.xxxxxxx.xx.xx	Xxxxxxx	2020-03-07	verified	Alto
4	XX.XXX.XXX.XX	xxxxxxxx.xxx	Xxxxxxx	2020-03-07	verified	Alto
5	XXX.XXX.XXX.XX		Xxxxxxx	2020-12-22	verified	Alto
6	XXX.XXX.XXX.XXX		Xxxxxxx	2020-03-07	verified	Alto
7	XXX.XXX.XXX.XXX		Xxxxxxx	2022-07-30	verified	Alto
8	XXX.XX.XX.XXX		Xxxxxxx	2020-12-22	verified	Alto

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-22	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	TXXXX	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Alto
4	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
6	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
9	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (16)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	.travis.yml	predictive	Medio
2	File	browse_group.asp	predictive	Alto
3	File	data/gbconfiguration.dat	predictive	Alto
4	File	xxxxx.xxx	predictive	Medio
5	File	xxxxxxxx.xxx	predictive	Medio
6	File	xxxxxxx.xxx	predictive	Medio
7	File	xxxx-xxxxxxxx.xxx	predictive	Alto
8	File	xxx.x	predictive	Bajo
9	File	xx-xxxxxxxx/xxxxxxx-xxxxxxxx.xxx	predictive	Alto
10	Library	xxxxxx/xxxxxxxxx/xxxxx.xxx	predictive	Alto
11	Argument	xxxxx->xxxx	predictive	Medio
12	Argument	xxxx	predictive	Bajo
13	Argument	xx	predictive	Bajo
14	Argument	xxxx	predictive	Bajo
15	Argument	xxxxx	predictive	Bajo
16	Network Port	xxx	predictive	Bajo

Referencias (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!