Dust Storm Análisis

IOB - Indicator of Behavior (1000)

Cronología

Idioma

en982
zh18

País

cn994
us6

Actores

Ocupaciones

Interesar

Cronología

Escribe

Proveedor

Producto

Microsoft Windows14
Qualcomm Snapdragon Auto14
Qualcomm Snapdragon Consumer IOT14
Qualcomm Snapdragon Industrial IOT14
Qualcomm Snapdragon Mobile14

Vulnerabilidad

#VulnerabilidadBaseTemp0dayHoyExpConEPSSCTICVE
1librsvg URL Decoder directory traversal4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001580.00CVE-2023-38633
2Pluck CMS Installation install.php cross site scripting3.53.5$0-$5k$0-$5kProof-of-ConceptNot Defined0.000510.16CVE-2023-5013
3Windriver VxWorks escalada de privilegios5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.011320.04CVE-2013-0716
4Windriver VxWorks cifrado débil7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.001510.04CVE-2010-2967
5Windriver VxWorks Hardcoded Credentials escalada de privilegios7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.003720.04CVE-2010-2966
6Cisco RV340 Web-based Management Interface desbordamiento de búfer5.55.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.006990.04CVE-2020-3451
7jeecgboot JimuReport Template escalada de privilegios7.57.3$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.004570.08CVE-2023-4450
8Adminer adminer.php escalada de privilegios7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020920.04CVE-2021-21311
9Wagtail String Comparison divulgación de información4.03.5$0-$5k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2020-11037
10Netgear D3600/D6000/D6100/R6100 desbordamiento de búfer7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.000790.00CVE-2018-21217
11Netgear WNR2050 Reflected cross site scripting4.44.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2018-21209
12pixl-class create escalada de privilegios8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.003470.00CVE-2020-7640
13Mozilla Firefox Private Browsing Password autenticación débil2.82.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2020-6824
14Mozilla Firefox/Firefox ESR/Thunderbird desbordamiento de búfer7.57.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.003090.00CVE-2020-6822
15Advanced Woo Search Plugin class-aws-search.php divulgación de información6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.002640.03CVE-2020-12070
16Nginx Controller TLS autenticación débil5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.001780.00CVE-2020-5864
17Netgear R7800 escalada de privilegios6.15.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2018-21106

Campañas (1)

These are the campaigns that can be associated with the actor:

  • Dust Storm

IOC - Indicator of Compromise (34)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDdirección IPHostnameActorCampañasIdentifiedEscribeConfianza
16.9.2.1Dust StormDust Storm2020-12-23verifiedAlto
223.238.229.128Dust StormDust Storm2020-12-23verifiedAlto
327.255.72.68Dust StormDust Storm2020-12-23verifiedAlto
427.255.72.69Dust StormDust Storm2020-12-23verifiedAlto
527.255.72.78Dust StormDust Storm2020-12-23verifiedAlto
659.120.59.259-120-59-2.hinet-ip.hinet.netDust StormDust Storm2020-12-23verifiedAlto
759.188.13.133Dust StormDust Storm2020-12-23verifiedAlto
8XX.XXX.XX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
9XX.XXX.XXX.XXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
10XX.XXX.XXX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
11XXX.X.X.XXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
12XXX.XX.XXX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
13XXX.XX.XXX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
14XXX.XXX.XX.XXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
15XXX.XXX.XX.XXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
16XXX.XX.XXX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
17XXX.XX.XXX.XXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
18XXX.XXX.XXX.XXxxxxxx-xx-xx-xxx-xxx-xxx.xxx.xxxxxx.xxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
19XXX.XXX.XXX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
20XXX.XX.XX.XXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
21XXX.XXX.XXX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
22XXX.XX.XX.XXxxx.xxxxxxx.xxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
23XXX.XXX.XXX.XXXxxx.xxxx.xxx.xxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
24XXX.XXX.XXX.XXXxxxxx.xxxx.xxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
25XXX.XXX.XX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
26XXX.XX.XX.XXXxx.xx.xx.xxxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
27XXX.X.XXX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
28XXX.XX.XXX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
29XXX.XX.XXX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
30XXX.XXX.XX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
31XXX.XX.XX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
32XXX.XX.XX.XXXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
33XXX.XX.XXX.XXxxx-xx-xxx-xx.xxxxx-xx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto
34XXX.XX.XXX.XXXxxx XxxxxXxxx Xxxxx2020-12-23verifiedAlto

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (187)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClaseIndicatorEscribeConfianza
1File.htaccesspredictiveMedio
2File/admin.php?p=/Area/index#tab=t2predictiveAlto
3File/bin/shpredictiveBajo
4File/gateway/services/EdgeServiceImplpredictiveAlto
5File/goform/net\_Web\_get_valuepredictiveAlto
6File/HNAP1predictiveBajo
7File/Maintenance/configfile.cfgpredictiveAlto
8File/module/comment/savepredictiveAlto
9File/restpredictiveBajo
10File/rootpredictiveBajo
11File/scripts/unlock_tasks.phppredictiveAlto
12File/tmppredictiveBajo
13File/topicpredictiveBajo
14File/upload/localhostpredictiveAlto
15File/wp-admin/admin-ajax.phppredictiveAlto
16Fileaccount/login.phppredictiveAlto
17FileActiveMQConnection.javapredictiveAlto
18FileActivityManagerService.javapredictiveAlto
19Fileadmin/app/mediamanagerpredictiveAlto
20Fileadmin/cms/template/getTemplates.html?res_path=respredictiveAlto
21Fileadmin/header.phppredictiveAlto
22Filexxxxx/xxxxxxxx/xxxxxxxxxxxx?xx=xxpredictiveAlto
23Filexxxxx/_xxxxxxx.xxxpredictiveAlto
24Filexxxxxxx.xxxpredictiveMedio
25Filexxxxxxxxxxxxx_xxxxxxxxxxxxxxx.xxxxpredictiveAlto
26Filexxx.xxx/xxx/xxxxxxpredictiveAlto
27Filexxx/xxxxxx/xxxxxxxxxx.xxxpredictiveAlto
28Filexxx/xxxxxx/xxxxxxxx/xxxxx/xxxxxxxx_xxxxxxx.xxxxx.xxxpredictiveAlto
29Filexxxxx/xxx_xxxx.xpredictiveAlto
30Filexxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveAlto
31Filexxxxxx/xxxxxx/predictiveAlto
32Filexxxxxxxxx-xxxxxxx/xxx/xxxx/xxxx/xx/xxxxxxx/xxxxxxxxx/xxxxxxx/xxxxxxx/xxxxxx.xxxxpredictiveAlto
33Filexxx_xx_xxx.xxpredictiveAlto
34Filexxxxxxxxxx.xpredictiveMedio
35Filexxxxx.xxpredictiveMedio
36Filexxx-xxx/xxxx/xxxxx/xxxxxxx/xxxxxxxx/xxxxxxxxpredictiveAlto
37Filexxx.xxxpredictiveBajo
38Filexxx.xxxxxxxx.xxxxxxx.xxx.xxx.xxxxxxxxxxxxxpredictiveAlto
39Filexxxxxxxxxx/xxx.xxpredictiveAlto
40Filexxxxxx.xxxpredictiveMedio
41Filexxxx/xxxxxxxxxxx.xxxpredictiveAlto
42Filexxxxx/xxxx/xxxxxxxxxxx/xxxxx/xxxxx.xxxpredictiveAlto
43Filexxxxxx_x_x.xxxpredictiveAlto
44Filexxxxxxxxx_xxx_xxxxxx_xxx/predictiveAlto
45Filexxxxxxx/xxx/xxxxxxxx/xxxxxxxxx/xxx/xxxxxx/xxxx.xpredictiveAlto
46Filexxxxxxx/xx/xxxxxxxx.xpredictiveAlto
47Filexxx_xxx.xpredictiveMedio
48Filexxxxxxx/xxxxxxxx.xxxpredictiveAlto
49Filexxx-xxxxx.xpredictiveMedio
50Filexxx/xxxxxx/xxx/?xxxxxx=xxxx&xx=xxxpredictiveAlto
51Filexxxxxxxx_xxx.xpredictiveAlto
52Filexxxxxx.xxxpredictiveMedio
53Filexxxxxxxxxxxxxxxxx.xxxxpredictiveAlto
54Filexxxxxxxx.xxpredictiveMedio
55Filexxxxxxxxxxxxxxxxxxxxxxxx.xxxpredictiveAlto
56Filexx/xxxx/xxxxx.xpredictiveAlto
57Filexxxxxxxxxx.xpredictiveMedio
58Filexxxxxx/xxxx/xxxxxx.xxxpredictiveAlto
59Filexxxxxxxxxxxxx.xxxpredictiveAlto
60Filexxxxx.xxxpredictiveMedio
61Filexxxx/xxxx.xpredictiveMedio
62Filexxxxxxxx/xxxx.xxxpredictiveAlto
63Filexxxxxxxx/xxxxx-xxx-xxxxxx.xxxpredictiveAlto
64Filexxxxx.xxxpredictiveMedio
65Filexxxxx.xxx?x=/xxxxx/xxxxxx/xxxxxx/xxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxpredictiveAlto
66Filexxxxx_xxxxxx.xxxpredictiveAlto
67Filexxxxxxx.xxxpredictiveMedio
68Filexxxxxxxxxxxxxxx.xxxxx.xxxxxxpredictiveAlto
69Filexxxxxxxx/xxxxx_xxxxxx.xxxpredictiveAlto
70Filexxx-xxxx.xpredictiveMedio
71Filexxxxxxxxxxx.xxpredictiveAlto
72Filexxxxxxx-xxxxxxx.xxxpredictiveAlto
73Filexxxxxxxx.xpredictiveMedio
74Filexxx.xpredictiveBajo
75Filexxxxxxxxxx/xxxxxx.xpredictiveAlto
76Filexxxxxxx/xxxxx.xpredictiveAlto
77Filexxxxxx.xpredictiveMedio
78Filexxxxxx_xxxx_xx_xx_xxx.xpredictiveAlto
79Filexxxxxxx/xxxxx_xxxx.xxxpredictiveAlto
80Filexxxx.xpredictiveBajo
81Filexxxxxxxx.xxxpredictiveMedio
82Filexxxxxx.xpredictiveMedio
83Filexxxxxxxx.xxxpredictiveMedio
84Filexxxxx.xpredictiveBajo
85Filexxx/xxxxxxxxxx/xxxxxx.xpredictiveAlto
86Filexxx/xxxx/xx_xxxx.xpredictiveAlto
87Filexxxxxx.xpredictiveMedio
88Filexxxx_xxxx.xxxpredictiveAlto
89Filexxxxx/xxxx-xxxxx.xxxpredictiveAlto
90Filexxxxxxxx.xxxpredictiveMedio
91Filexxxx.xxxpredictiveMedio
92Filexxxxxxxxxxxxxx.xxxpredictiveAlto
93Filexxxxxxxx_xxx.xxxpredictiveAlto
94Filexx-xxxxx/xxxxx.xxx?xxx=xxxx&xxx=xxxxxxpredictiveAlto
95Filexxxxxxx.xxxpredictiveMedio
96Filexxxxxx/xxx.xxxpredictiveAlto
97Filexxxxx.xxxpredictiveMedio
98Filex/xxxxx/xxxxxxx/xxxx/xxxpredictiveAlto
99Filexxxxxxx/xxxxxxxxxx.xxxpredictiveAlto
100Filexxxxxx-xxx-xxxx.xpredictiveAlto
101Filexxxxxxxxxxxxxxxxxxx.xxxxpredictiveAlto
102Filexxxxx/xxxxxxxxxx/xxxxxxxxxxx/xxxxxxxxxxxxxxxxxx.xxxxpredictiveAlto
103Filexxxxxxxxxx.xpredictiveMedio
104Filexxxxxx/xxxx_xxxxxxx?xxxpredictiveAlto
105Filexxxxxxxxxxxx/xxxxx.xxpredictiveAlto
106Filexxx_xxxxx.xpredictiveMedio
107Filexxxxx/xxxx_xxxx.xpredictiveAlto
108Filexxx.xxxpredictiveBajo
109Filexxxx/xxxx.xxxpredictiveAlto
110Filexxxxx/x/xxxxpredictiveMedio
111Filexxxx_xxxxxx.xxxpredictiveAlto
112Filexxx_xxxxxx.xpredictiveMedio
113FilexxxxxxxxxxpredictiveMedio
114Filexxxxxxxxxxxxx.xxxpredictiveAlto
115Filexxxxxxxxxxx.xxxpredictiveAlto
116Filexx-xxxxx/xxxxx-xxxx.xxx?xxxxxx=xxxx_xxxxxxx_xxxx_xxxxxxxpredictiveAlto
117Filexx.xxxpredictiveBajo
118Filexxxxxxxx.xpredictiveMedio
119Libraryxxxxxxxxx.xxxpredictiveAlto
120Libraryxxx/xxxx/xxxxxxxxxx.xxpredictiveAlto
121Libraryxxxxxxx_xxxxx_xxxxxxpredictiveAlto
122Libraryxxxxx.xxxpredictiveMedio
123Libraryxxxxxx/xxxx/xxxxxx/xxxxx.xpredictiveAlto
124Libraryxxxxx.xxxpredictiveMedio
125Libraryxxxxx.xxxpredictiveMedio
126Argument-xpredictiveBajo
127ArgumentxxxxxxxxxxxpredictiveMedio
128Argumentxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxx/xxxxx/xxxxx_xxxxxxxpredictiveAlto
129ArgumentxxxxxpredictiveBajo
130Argumentxxxxxxx/xxxxxxxxpredictiveAlto
131ArgumentxxxxxxxxpredictiveMedio
132Argumentxxxxxxx/xxxxpredictiveMedio
133ArgumentxxxxxxxxpredictiveMedio
134ArgumentxxxxxpredictiveBajo
135ArgumentxxxxxxxxxxxxxxxxpredictiveAlto
136ArgumentxxxpredictiveBajo
137ArgumentxxxxxxpredictiveBajo
138Argumentxxxxx_xxxxpredictiveMedio
139Argumentxxxxxx[xxxxxxxxxxxxxx]predictiveAlto
140Argumentxxxxxxxxx/xxxxxxxxxx/xxxxx/xxxxxxx/xxxxxxx/xxxxxxxxpredictiveAlto
141ArgumentxxxxpredictiveBajo
142ArgumentxxxxxxpredictiveBajo
143ArgumentxxxxxxxxxpredictiveMedio
144ArgumentxxxxxpredictiveBajo
145ArgumentxxxxxxxpredictiveBajo
146ArgumentxxxpredictiveBajo
147Argumentx_xxpredictiveBajo
148ArgumentxxxxpredictiveBajo
149Argumentxxxx_xxpredictiveBajo
150ArgumentxxxxxxxxpredictiveMedio
151ArgumentxxxpredictiveBajo
152Argumentxxxxxxxxxx/xxxxxxxxxxxxpredictiveAlto
153ArgumentxxxxxpredictiveBajo
154Argumentxxx_xxxxxpredictiveMedio
155ArgumentxxxxxxxxpredictiveMedio
156ArgumentxxxxxxxxpredictiveMedio
157ArgumentxxxxxxxxpredictiveMedio
158ArgumentxxxpredictiveBajo
159ArgumentxxxxxxxxpredictiveMedio
160Argumentxxxx_xxpredictiveBajo
161ArgumentxxxxxxxxxxxxxxxxpredictiveAlto
162ArgumentxxxxxxxxxxxxxxpredictiveAlto
163ArgumentxxxxxxpredictiveBajo
164ArgumentxxxxxxxxxxxxxxxxxxxpredictiveAlto
165ArgumentxxxxxxxxxxxxxxxpredictiveAlto
166Argumentxxxxxxxx/xxxxxxxxxxxxxpredictiveAlto
167ArgumentxxxpredictiveBajo
168ArgumentxxxxpredictiveBajo
169Argumentxxxxxx-xxxpredictiveMedio
170Argumentxxxxxx xxxxx/xxxxxx xxxxpredictiveAlto
171ArgumentxxxxxxxxxpredictiveMedio
172ArgumentxxxxxxxxxxpredictiveMedio
173Argumentxx_xxxx_xxxxxxx/xx_xxxxxx_xxxxxxxxpredictiveAlto
174Input Value../predictiveBajo
175Input Valuex xxx xxxxx(x)predictiveAlto
176Input ValuexxxxxxxxpredictiveMedio
177Input Value<?xxxpredictiveBajo
178Input Value<xxxxxx>xxxxx('xxx')</xxxxxx>predictiveAlto
179Input Valuexxxx@xxpredictiveBajo
180Input ValuexxxxxxxxpredictiveMedio
181Input Valuexxxxxxxxxx&#x;:xxxxxpredictiveAlto
182Input Valuexxxx=xxx-xxxxxxxx-xxxxxxxpredictiveAlto
183Network PortxxxxpredictiveBajo
184Network Portxxx/xx (xxx)predictiveMedio
185Network Portxxx/xxxpredictiveBajo
186Network Portxxx/xxxxpredictiveMedio
187Network Portxxx/xxxxxpredictiveMedio

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!