APT37 Analyse

IOB - Indicator of Behavior (117)

Chronologie

Langue

en88
de24
es2
zh2
pl2

De campagne

us100
pl10
vn2
ru2

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

phpMyAdmin4
PHP4
TikiWiki2
WordPress2
FLDS2

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConEPSSCTICVE
1PHP phpinfo cross site scripting4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.021010.05CVE-2007-1287
2Lars Ellingsen Guestserver guestbook.cgi cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001690.14CVE-2005-4222
3RDM Intuitive 650 TDB Controller Password elévation de privilèges7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.002060.03CVE-2016-4505
4Siemens EN100 Ethernet Module Web Server Memory divulgation de l'information5.35.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.005160.00CVE-2016-4785
5DZCP deV!L`z Clanportal config.php elévation de privilèges7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009431.15CVE-2010-0966
6Siemens EN100 Ethernet Module Web Server divulgation de l'information5.35.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.005160.03CVE-2016-4784
7RDM Intuitive 650 TDB Controller cross site request forgery6.15.8$0-$5k$0-$5kNot DefinedOfficial Fix0.000690.00CVE-2016-4506
8TikiWiki tiki-register.php elévation de privilèges7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.010092.07CVE-2006-6168
9LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000003.04
10MGB OpenSource Guestbook email.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.013020.88CVE-2007-0354
11FLDS redir.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.002030.09CVE-2008-5928
12SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injection7.16.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001350.09CVE-2023-2090
13Apple Mac OS X Server Wiki Server sql injection5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.003392.67CVE-2015-5911
14Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting3.23.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000730.09CVE-2018-25085
15PHPWind goto.php Redirect6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.003480.09CVE-2015-4134
16Winn Winn GuestBook addPost cross site scripting4.34.1$0-$5k$0-$5kHighOfficial Fix0.003360.02CVE-2011-5026
17Cplinks cpDynaLinks category.php sql injection7.37.1$0-$5k$0-$5kHighUnavailable0.003870.02CVE-2007-5408
18vldPersonals index.php cross site scripting4.33.9$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.001550.04CVE-2014-9004
19esoftpro Online Guestbook Pro ogp_show.php sql injection7.37.1$0-$5k$0-$5kHighUnavailable0.001350.05CVE-2010-4996
20PHP locale_methods.c get_icu_disp_value_src_php buffer overflow8.58.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.010860.04CVE-2014-9912

Campagnes (3)

These are the campaigns that can be associated with the actor:

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1059CWE-94Argument InjectionpredictiveÉlevé
2T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveÉlevé
3TXXXXCWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
4TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
5TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveÉlevé
6TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
7TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
8TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé

IOA - Indicator of Attack (29)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File/admin/maintenance/view_designation.phppredictiveÉlevé
2File/forum/away.phppredictiveÉlevé
3Fileadclick.phppredictiveMoyen
4Filecategory.phppredictiveMoyen
5Filexxxxx.xxxpredictiveMoyen
6Filexxxxxxxx/xxxxxx.xxxpredictiveÉlevé
7Filexxx/xxxx/xxxxxx/xxxxxx_xxxxxxx.xpredictiveÉlevé
8Filexxxxxxxxxxx.xxxpredictiveÉlevé
9Filexxxx.xxxpredictiveMoyen
10Filexxxxxxxxx.xxxpredictiveÉlevé
11Filexxx/xxxxxx.xxxpredictiveÉlevé
12Filexxxxxxxx/xxxxxxx.xxxpredictiveÉlevé
13Filexxxxx.xxxpredictiveMoyen
14Filexxxxxxxxx/xxxxxx.xxxpredictiveÉlevé
15Filexxx_xxxx.xxxpredictiveMoyen
16Filexxxxx.xxxpredictiveMoyen
17Filexxxxxxxxxx_xxxxx.xxxxxxpredictiveÉlevé
18Filexxxx-xxxxxxxx.xxxpredictiveÉlevé
19Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveÉlevé
20ArgumentxxxxxxxxpredictiveMoyen
21ArgumentxxxxxxxxpredictiveMoyen
22ArgumentxxxxpredictiveFaible
23ArgumentxxpredictiveFaible
24ArgumentxxxpredictiveFaible
25ArgumentxxxxpredictiveFaible
26ArgumentxxxxxxxxpredictiveMoyen
27ArgumentxxxxxxpredictiveFaible
28ArgumentxxxxxxxxpredictiveMoyen
29ArgumentxxxpredictiveFaible

Références (5)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!