Bahamut Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (12)

Langue

de	8
en	4

De campagne

us	12

Acteurs

Bahamut	2

Intérêt

Taper

Not Defined	6
Multimedia Player Software	2
Hosting Control Software	2
Router Operating System	2

Fournisseur

Not Defined	4
NullSoft	2
Parallels	2
Cisco	2
EdgeMAX	2

Produit

NullSoft WinAmp	2
Parallels Plesk Panel	2
MyPhPim	2
Cisco Linksys EA2700	2
EdgeMAX EdgeSwitch	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	EdgeMAX EdgeSwitch elévation de privilèges	8.0	7.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00123	0.02	CVE-2019-5446
2	EdgeMAX EdgeSwitch HTTP Interface elévation de privilèges	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00402	0.03	CVE-2020-8233
3	Parallels Plesk Panel Administration Panel login_up.php3 divulgation de l'information	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00302	0.00	CVE-2011-4728
4	Parallels Plesk Panel Control Panel login_up.php3 chiffrement faible	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00226	0.02	CVE-2011-4736
5	SPIP spip_pass.php3 cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.04
6	MyPhPim Login Page calendar.php3 sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.19924	0.00	CVE-2006-0167
7	Phpheaven PHPMyChat start_page.css.php3 cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00265	0.00	CVE-2005-1619
8	NullSoft WinAmp FLV File buffer overflow	6.8	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00044	0.00	CVE-2017-10725
9	Cisco Linksys EA2700 URL divulgation de l'information	4.3	4.1	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.08
10	Dating Script see_more_details.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
11	Itech Dating Script see_more_details.php sql injection	7.5	7.2	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00391	0.04	CVE-2017-20135
12	Maran PHP Shop prod.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00137	0.03	CVE-2008-4879

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	104.21.10.79		Bahamut	05/03/2024	verified	Élevé
2	XXX.XXX.XXX.XXX	xxx-xxxxxxxxx-x.xxx-xxx.xxx	Xxxxxxx	11/12/2023	verified	Élevé
3	XXX.XXX.XXX.XXX	xxx-xxxxxxxxx-x.xxx-xxx.xxx	Xxxxxxx	30/01/2024	verified	Élevé
4	XXX.XX.XXX.XX		Xxxxxxx	05/03/2024	verified	Élevé

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Élevé
2	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
3	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
4	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
5	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé

IOA - Indicator of Attack (10)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/see_more_details.php	predictive	Élevé
2	File	calendar.php3	predictive	Élevé
3	File	xxxxx_xx.xxxx	predictive	Élevé
4	File	xxxx.xxx	predictive	Moyen
5	File	xxxx_xxxx.xxxx	predictive	Élevé
6	File	xxxxx_xxxx.xxx.xxxx	predictive	Élevé
7	Argument	xxx_xx	predictive	Faible
8	Argument	xxx	predictive	Faible
9	Argument	xxxxxxxx	predictive	Moyen
10	Argument	xx	predictive	Faible

Références (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Do you know our Splunk app?

Download it now for free!